Hamza-AyedandClaude Opus 5
db4ca7dd7a
Hotfix: a comment added to the dashboard SQL contained double quotes inside
the double-quoted PHP string, terminating it and making dashbord.php fail to
parse. Production was returning a parse error for every dashboard request.
Authorisation gaps closed — connect.php only proves a token is valid, it does
not check what the caller is allowed to do:
- Admin/ggg.php decrypts any database field and was authorised solely by an
admin phone number sent in the request body. Anyone who knew a listed
number could decrypt platform data without signing in. It now runs behind
connect.php, requires super_admin, keeps the phone list as a second factor,
and records every use.
- ride/kazan/update.php, kazan/add.php and ride/promo/{add,update,delete}.php
changed live pricing and discount codes with no role check at all, so any
valid token — including a driver's or passenger's — could rewrite the fare
table. All now require super_admin.
Staff/pending.php: adminUser has no `status` column in this deployment, so
the query failed with an opaque "unavailable". It now checks for the column
and reports the actual reason.
Console: Kazan tariff editor for super admins — sends only changed fields,
shows an old → new confirmation before saving, and stays read-only with an
explanatory notice for plain admins.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
80 lines
3.2 KiB
PHP
80 lines
3.2 KiB
PHP
<?php
|
|
// ============================================================
|
|
// Admin/ggg.php
|
|
// أداة تشفير وفك تشفير للمشرفين
|
|
// ============================================================
|
|
|
|
// ============================================================
|
|
// المصادقة: هذه الأداة تفك تشفير أي حقل في قاعدة البيانات، لذا تمر عبر
|
|
// connect.php (JWT + بصمة الجهاز + Rate limiting) ثم تتطلب دور super_admin.
|
|
//
|
|
// سابقاً كان الإذن الوحيد هو رقم هاتف يُرسل داخل جسم الطلب نفسه — وهو ليس
|
|
// سرّاً: أي شخص يعرف رقماً من القائمة كان يستطيع فك تشفير بيانات المنصة
|
|
// كاملةً بلا تسجيل دخول. أُبقيت قائمة الأرقام كطبقة ثانية فوق التوكن.
|
|
// ============================================================
|
|
require_once __DIR__ . '/../connect.php';
|
|
|
|
// نضمن أن الرد دائماً JSON
|
|
header('Content-Type: application/json; charset=utf-8');
|
|
|
|
if ($role !== 'super_admin') {
|
|
securityLog("Unauthorized encrypt/decrypt attempt", [
|
|
'user_id' => $user_id ?? 'unknown',
|
|
'role' => $role ?? 'none',
|
|
]);
|
|
jsonError('Forbidden. Super Admin access required.', 403);
|
|
}
|
|
|
|
// 1) قراءة الـ body كـ JSON أو POST
|
|
$action = filterRequest('action');
|
|
$text = filterRequest('text');
|
|
$adminPhoneParam = filterRequest('admin_phone');
|
|
|
|
// 2) طبقة ثانية: رقم الهاتف يجب أن يكون ضمن القائمة المصرّح لها (إن وُجدت)
|
|
$phonesRaw = getenv('ADMIN_PHONE_NUMBERS') ?: '';
|
|
$ALLOWED_TOOL_PHONES = array_values(
|
|
array_filter(
|
|
array_map(function ($p) {
|
|
return preg_replace('/\D+/', '', $p);
|
|
}, explode(',', $phonesRaw))
|
|
)
|
|
);
|
|
|
|
$adminPhoneParam = $adminPhoneParam ? preg_replace('/\D+/', '', $adminPhoneParam) : '';
|
|
|
|
if (!empty($ALLOWED_TOOL_PHONES)
|
|
&& ($adminPhoneParam === '' || !in_array($adminPhoneParam, $ALLOWED_TOOL_PHONES, true))) {
|
|
securityLog("Encrypt/decrypt phone not in allow-list", [
|
|
'user_id' => $user_id ?? 'unknown',
|
|
'phone' => $adminPhoneParam,
|
|
]);
|
|
jsonError('Access denied for this admin phone.', 403);
|
|
}
|
|
|
|
// 3) سجل تدقيق: كل استخدام لهذه الأداة يُسجَّل مع هوية المنفّذ
|
|
securityLog("Encryption tool used", [
|
|
'user_id' => $user_id ?? 'unknown',
|
|
'action' => $action,
|
|
'ip' => $_SERVER['REMOTE_ADDR'] ?? 'unknown',
|
|
]);
|
|
|
|
if (empty($text) || ($action !== 'encrypt' && $action !== 'decrypt')) {
|
|
jsonError('Invalid input: need action=encrypt|decrypt and non-empty text.', 400);
|
|
}
|
|
|
|
// 4) تنفيذ التشفير / الفك (التوافق مع CBC الحالي)
|
|
try {
|
|
if ($action === 'encrypt') {
|
|
$result = $encryptionHelper->encryptData($text);
|
|
} else { // decrypt
|
|
$result = $encryptionHelper->decryptData($text);
|
|
}
|
|
|
|
jsonSuccess([
|
|
'action' => $action,
|
|
'result' => (string) $result,
|
|
]);
|
|
} catch (Exception $e) {
|
|
securityLog("Encryption tool failed", ['error' => $e->getMessage()]);
|
|
jsonError('Operation failed.', 500);
|
|
} |