Hamza-AyedandClaude Opus 5
2135edcf43
- Customer-service notes joined to the account by comparing encrypted phone columns. Both notes tables now carry phone_key, written when a note is saved, and the three joins match on it. - The email_verifications join was comparing a plaintext column against an encrypted one, so it never matched and `verified` was always NULL in both passenger and driver sign-in. It is now resolved in PHP against the decrypted address, which fixes a pre-existing bug rather than only preparing for GCM. - auth/sendVerifyEmail.php built all three of its statements by interpolating the request values into SQL. Any caller could inject through the email or token field. Now parameterised. - serviceapp/register.php duplicate detection consults the users indexes and writes them with the row. Sweep confirms no join or lookup compares two encrypted columns any more. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
71 lines
2.1 KiB
PHP
71 lines
2.1 KiB
PHP
<?php
|
|
require_once __DIR__ . '/../connect.php';
|
|
|
|
$email = filterRequest("email");
|
|
$token = filterRequest("token");
|
|
|
|
$stmt = $con->prepare("SELECT * FROM `email_verifications` WHERE `email` = ?");
|
|
$stmt->execute([$email]);
|
|
|
|
$rowCount = $stmt->rowCount();
|
|
|
|
$admin='support@mobile-app.store';
|
|
$headers = "MIME-Version: 1.0" . "\r\n";
|
|
$headers .= "Content-type: text/html; charset=UTF-8" . "\r\n";
|
|
$headers .= "From: $admin" . "\r\n";
|
|
|
|
$subject = "Verify your email address";
|
|
$bodyEmail = "
|
|
<html>
|
|
<head>
|
|
<title>Verify your email address</title>
|
|
</head>
|
|
<body>
|
|
<p>Hi [$email],</p>
|
|
|
|
<p>We recently received a request to verify your email address for your account on SEFER App.</p>
|
|
|
|
<p>To verify your email address, please write this to app .</p>
|
|
$token
|
|
|
|
<p>If you did not request to verify your email address, please ignore this email.</p>
|
|
|
|
<p>Thank you,</p>
|
|
SEFER Team.
|
|
</body>
|
|
</html>
|
|
";
|
|
|
|
|
|
|
|
if ($rowCount > 0) {
|
|
// The email already exists, so update the data
|
|
// كانت القيم تُدمج في نص الاستعلام مباشرةً — حقن SQL عبر البريد أو الرمز.
|
|
$stmt = $con->prepare("UPDATE `email_verifications` SET `token` = ? WHERE `email` = ?");
|
|
$stmt->execute([$token, $email]);
|
|
|
|
if ($stmt->rowCount() > 0) {
|
|
// The update was successful
|
|
jsonSuccess($message = "Email verification data updated successfully");
|
|
mail($email, $subject, $bodyEmail, $headers);
|
|
} else {
|
|
// The update was unsuccessful
|
|
jsonError($message = "Failed to update email verification data");
|
|
}
|
|
} else {
|
|
// The email does not exist, so insert the data
|
|
$stmt = $con->prepare("INSERT INTO `email_verifications` (`email`, `token`) VALUES (?, ?)");
|
|
$stmt->execute([$email, $token]);
|
|
|
|
if ($stmt->rowCount() > 0) {
|
|
// The insertion was successful
|
|
jsonSuccess($message = "Email verification data saved successfully");
|
|
mail($email, $subject, $bodyEmail, $headers);
|
|
} else {
|
|
// The insertion was unsuccessful
|
|
jsonError($message = "Failed to save email verification data");
|
|
}
|
|
}
|
|
?>
|
|
|