Hamza-AyedandClaude Opus 5
a1c19b052d
The verification tables (token_verification*, phone_verification*) use the phone number as a lookup key: written when the code is sent, read when it is checked. Storing it encrypted worked only because encryptData() is deterministic — under AES-GCM the two sides would produce different ciphertexts and no code would ever verify, locking every user out of registration and OTP sign-in. otpPhoneKey() stores a keyed HMAC of the normalised number instead. No schema change is needed since the column is textual, local and international formats now resolve to the same key, and the value cannot be reversed without the pepper. It falls back to the previous behaviour when no pepper is configured. Applied to both sides of every affected flow — request/verify, and the driver and passenger send/verify pairs — including the OTP value itself where it is compared by equality rather than decrypted. auth/otp/verify.php already decrypts the token before comparing, so it needed no change there. Also adds ENCRYPTION_MODE to EncryptionHelper: encryptData() writes GCM when set to 'gcm', CBC otherwise. Verified in both directions — rows written under CBC stay readable after switching, and rows written under GCM stay readable after rolling back — so the switch is reversible by an environment variable. The admin console's own OTP is unaffected: it keys the table by the stored ciphertext read from adminUser, identical on both sides. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
83 lines
2.9 KiB
PHP
83 lines
2.9 KiB
PHP
<?php
|
|
require_once __DIR__ . '/../../../connect.php';
|
|
|
|
$phoneNumber = filterRequest("phone_number");
|
|
$otp = filterRequest("otp");
|
|
|
|
if (empty($phoneNumber) || empty($otp)) {
|
|
jsonError("Phone number and OTP are required.");
|
|
exit();
|
|
}
|
|
|
|
$phoneNumber_encrypted = otpPhoneKey($phoneNumber);
|
|
// الرمز يُقارن بالتساوي أيضاً، فيحتاج نفس الصيغة الثابتة
|
|
$otp_encrypted = otpPhoneKey($otp);
|
|
|
|
try {
|
|
$stmt = $con->prepare("
|
|
SELECT * FROM token_verification_driver
|
|
WHERE phone_number = ? AND token = ?
|
|
");
|
|
$stmt->execute([$phoneNumber_encrypted, $otp_encrypted]);
|
|
$result = $stmt->fetch(PDO::FETCH_ASSOC);
|
|
|
|
if ($result) {
|
|
$expiration_time = strtotime($result['expiration_time']);
|
|
|
|
if (time() <= $expiration_time) {
|
|
$con->prepare("UPDATE token_verification_driver SET verified = 1 WHERE id = ?")
|
|
->execute([$result['id']]);
|
|
|
|
$driverStmt = $con->prepare("SELECT id FROM driver WHERE phone = ?");
|
|
$driverStmt->execute([$phoneNumber_encrypted]);
|
|
$driver = $driverStmt->fetch(PDO::FETCH_ASSOC);
|
|
|
|
if ($driver) {
|
|
$driverID = $driver['id'];
|
|
$newToken = filterRequest("token");
|
|
$fingerPrint = filterRequest("fingerPrint");
|
|
|
|
if ($newToken && $fingerPrint) {
|
|
$tokenEncrypted = $encryptionHelper->encryptData($newToken);
|
|
|
|
$checkTokenStmt = $con->prepare("SELECT id FROM driverToken WHERE captain_id = ?");
|
|
$checkTokenStmt->execute([$driverID]);
|
|
|
|
if ($checkTokenStmt->rowCount() > 0) {
|
|
$con->prepare("UPDATE driverToken SET token = ?, fingerPrint = ? WHERE captain_id = ?")
|
|
->execute([$tokenEncrypted, $fingerPrint, $driverID]);
|
|
} else {
|
|
$con->prepare("INSERT INTO driverToken (token, fingerPrint, captain_id, created_at) VALUES (?, ?, ?, NOW())")
|
|
->execute([$tokenEncrypted, $fingerPrint, $driverID]);
|
|
}
|
|
|
|
$response = [
|
|
"message" => "Driver token verified and updated.",
|
|
"isRegistered" => true,
|
|
"driverID" => $driverID
|
|
];
|
|
jsonSuccess($response);
|
|
|
|
} else {
|
|
jsonError("Token or fingerprint missing.");
|
|
}
|
|
|
|
} else {
|
|
printSuccess([
|
|
"message" => "Phone verified, but driver not found.",
|
|
"isRegistered" => false
|
|
]);
|
|
}
|
|
|
|
} else {
|
|
jsonError("OTP expired. Request a new one.");
|
|
}
|
|
|
|
} else {
|
|
jsonError("Invalid OTP.");
|
|
}
|
|
|
|
} catch (PDOException $e) {
|
|
error_log("[verify_otp_driver.php] " . $e->getMessage());
|
|
jsonError("Database error occurred.");
|
|
} |