Hamza-AyedandClaude Opus 5
a1c19b052d
The verification tables (token_verification*, phone_verification*) use the phone number as a lookup key: written when the code is sent, read when it is checked. Storing it encrypted worked only because encryptData() is deterministic — under AES-GCM the two sides would produce different ciphertexts and no code would ever verify, locking every user out of registration and OTP sign-in. otpPhoneKey() stores a keyed HMAC of the normalised number instead. No schema change is needed since the column is textual, local and international formats now resolve to the same key, and the value cannot be reversed without the pepper. It falls back to the previous behaviour when no pepper is configured. Applied to both sides of every affected flow — request/verify, and the driver and passenger send/verify pairs — including the OTP value itself where it is compared by equality rather than decrypted. auth/otp/verify.php already decrypts the token before comparing, so it needed no change there. Also adds ENCRYPTION_MODE to EncryptionHelper: encryptData() writes GCM when set to 'gcm', CBC otherwise. Verified in both directions — rows written under CBC stay readable after switching, and rows written under GCM stay readable after rolling back — so the switch is reversible by an environment variable. The admin console's own OTP is unaffected: it keys the table by the stored ciphertext read from adminUser, identical on both sides. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
88 lines
2.5 KiB
PHP
88 lines
2.5 KiB
PHP
<?php
|
|
// File: send_otp.php (بديل عن النسخة المعتمدة على RaseelPlus)
|
|
require_once __DIR__ . '/../../connect.php';
|
|
|
|
/* 1) توليد رمز التحقق (3 خانات) */
|
|
$otp = (string)random_int(100, 999);
|
|
$receiver = filterRequest("receiver");
|
|
|
|
if (empty($receiver)) {
|
|
jsonError('Phone number is required.');
|
|
exit();
|
|
}
|
|
|
|
/* 2) إرسال عبر بوابة الفلاش كول / واتساب */
|
|
$nabehUrl = 'https://otp.intaleqapp.com/api/request-otp.php';
|
|
$appKey = getenv('NABEH_OTP_APP_KEY');
|
|
|
|
$payload = [
|
|
'phone' => $receiver,
|
|
'device_type' => 'android',
|
|
'method' => 'whatsapp',
|
|
'code' => $otp
|
|
];
|
|
|
|
$ch = curl_init($nabehUrl);
|
|
curl_setopt_array($ch, [
|
|
CURLOPT_POST => true,
|
|
CURLOPT_RETURNTRANSFER => true,
|
|
CURLOPT_POSTFIELDS => json_encode($payload),
|
|
CURLOPT_HTTPHEADER => [
|
|
'Content-Type: application/json',
|
|
"X-App-Key: $appKey"
|
|
],
|
|
CURLOPT_TIMEOUT => 15,
|
|
CURLOPT_CONNECTTIMEOUT => 5
|
|
]);
|
|
|
|
$res = curl_exec($ch);
|
|
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
|
|
$error = curl_error($ch);
|
|
curl_close($ch);
|
|
|
|
if ($error) {
|
|
error_log("⚠️ [Flash Call OTP Token Passenger] Curl Error: $error");
|
|
jsonError('Failed to connect to OTP service');
|
|
exit;
|
|
}
|
|
|
|
$decoded = json_decode((string)$res, true);
|
|
$sentOK = ($httpCode === 200 && ($decoded['success'] ?? false));
|
|
|
|
if ($sentOK) {
|
|
/* 3) حفظ الرمز في Redis + قاعدة البيانات */
|
|
$receiver_enc = otpPhoneKey($receiver);
|
|
$otp_enc = otpPhoneKey($otp); // يجب أن يطابق صيغة المقارنة في verify_otp
|
|
|
|
$exp = date('Y-m-d H:i:s', strtotime('+5 minutes'));
|
|
$now = date('Y-m-d H:i:s');
|
|
|
|
try {
|
|
// Save to MySQL
|
|
$con->prepare("DELETE FROM token_verification WHERE phone_number = ?")
|
|
->execute([$receiver_enc]);
|
|
|
|
$stmt = $con->prepare("
|
|
INSERT INTO token_verification
|
|
(phone_number, token, expiration_time, verified, created_at)
|
|
VALUES (?, ?, ?, 0, ?)
|
|
");
|
|
$stmt->execute([$receiver_enc, $otp_enc, $exp, $now]);
|
|
|
|
// Also save to Redis for verify_otp.php compatibility
|
|
if ($redis) {
|
|
$redis->setex("otp:passenger:$receiver", 300, $otp);
|
|
}
|
|
|
|
jsonSuccess(null, 'OTP sent and saved successfully');
|
|
|
|
} catch (PDOException $e) {
|
|
error_log("[send_otp.php] " . $e->getMessage());
|
|
jsonError('OTP sent but failed to save to database');
|
|
}
|
|
|
|
} else {
|
|
$errMsg = $decoded['message'] ?? 'Unknown error';
|
|
jsonError('Failed to send OTP');
|
|
}
|
|
?>
|