3543fdd2cd
H-01: Egypt document uploads - added path traversal prevention (basename),
replaced HTTP_HOST with APP_DOMAIN env var
H-02: 7 remaining hardcoded /home/siro-api/ paths replaced with env vars
(ENV_FILE_PATH, INTERNAL_SOCKET_KEY_PATH, WEBHOOK_SECRET_KEY_PATH)
H-03: serviceapp/updateDriver.php - added ownership check (user_id must match
driverID or user must be admin); non-admins blocked from changing
password/status/email/phone
H-04: ggg.php - replaced weak client-supplied phone auth with proper admin
JWT authentication via JwtService
H-05: Static IV fallback in encrypt_decrypt.php already documented as legacy
H-06: Wallet shared password noted as design limitation (mitigated by
fingerprint verification + short token TTL)
- Also fixed functions.php log message (removed hardcoded path)
98 lines
3.2 KiB
PHP
98 lines
3.2 KiB
PHP
<?php
|
|
require_once __DIR__ . '/../connect.php';
|
|
|
|
// Retrieve driverID (allow 'id' or 'driverID')
|
|
$driverID = filterRequest("id") ?? filterRequest("driverID");
|
|
if (!$driverID) {
|
|
jsonError("Driver ID is required");
|
|
exit;
|
|
}
|
|
|
|
// التحقق من أن المستخدم يملك هذا الحساب أو هو أدمن
|
|
$canUpdate = ($role === 'admin' || $role === 'super_admin' || (string)$user_id === (string)$driverID);
|
|
if (!$canUpdate) {
|
|
jsonError("Unauthorized: You can only update your own account");
|
|
exit;
|
|
}
|
|
|
|
/* ---------------------------------------------------------
|
|
DRIVER TABLE
|
|
--------------------------------------------------------- */
|
|
$driverFieldsAllowed = [
|
|
"idn", "phone", "email", "password", "gender", "license_type",
|
|
"national_number", "name_arabic", "issue_date", "expiry_date",
|
|
"license_categories", "address", "licenseIssueDate", "status",
|
|
"birthdate", "site", "first_name", "last_name", "accountBank",
|
|
"bankCode", "employmentType", "maritalStatus", "fullNameMaritial",
|
|
"expirationDate", "created_at", "updated_at"
|
|
];
|
|
|
|
// إزالة الحقول الحساسة من التحديث إذا كان المستخدم ليس أدمن
|
|
if ($role !== 'admin' && $role !== 'super_admin') {
|
|
$driverFieldsAllowed = array_diff($driverFieldsAllowed, ['password', 'status', 'email', 'phone']);
|
|
}
|
|
|
|
$encryptedDriverFields = [
|
|
"phone", "email", "password", "national_number","gender", "name_arabic", "first_name",
|
|
"last_name", "birthdate", "site", "maritalStatus", "employmentType", "accountBank", "bankCode"
|
|
];
|
|
|
|
$driverSet = [];
|
|
$driverParams = [":id" => $driverID];
|
|
|
|
foreach ($driverFieldsAllowed as $field) {
|
|
if (isset($_POST[$field]) && $_POST[$field] !== "") {
|
|
$value = filterRequest($field);
|
|
|
|
if (in_array($field, $encryptedDriverFields)) {
|
|
$value = $encryptionHelper->encryptData($value);
|
|
}
|
|
|
|
$driverSet[] = "`$field` = :$field";
|
|
$driverParams[":$field"] = $value;
|
|
}
|
|
}
|
|
|
|
$driverUpdated = false;
|
|
if (!empty($driverSet)) {
|
|
$driverSql = "UPDATE `driver` SET " . implode(", ", $driverSet) . " WHERE `id` = :id";
|
|
$stmt = $con->prepare($driverSql);
|
|
$stmt->execute($driverParams);
|
|
$driverUpdated = $stmt->rowCount() > 0;
|
|
}
|
|
|
|
/* ---------------------------------------------------------
|
|
CAR REGISTRATION TABLE
|
|
--------------------------------------------------------- */
|
|
$carFieldsAllowed = [
|
|
"id", "vin", "car_plate", "make", "model", "year",
|
|
"expiration_date", "color", "owner", "color_hex", "fuel",
|
|
"isDefault", "created_at", "status"
|
|
];
|
|
|
|
$carSet = [];
|
|
$carParams = [":driverID" => $driverID];
|
|
|
|
foreach ($carFieldsAllowed as $field) {
|
|
if ($field === "id") continue;
|
|
if (isset($_POST[$field]) && $_POST[$field] !== "") {
|
|
$value = filterRequest($field);
|
|
$carSet[] = "`$field` = :$field";
|
|
$carParams[":$field"] = $value;
|
|
}
|
|
}
|
|
|
|
$carUpdated = false;
|
|
if (!empty($carSet)) {
|
|
$carSql = "UPDATE `CarRegistration` SET " . implode(", ", $carSet) . " WHERE `driverID` = :driverID";
|
|
$stmtCar = $con->prepare($carSql);
|
|
$stmtCar->execute($carParams);
|
|
$carUpdated = $stmtCar->rowCount() > 0;
|
|
}
|
|
|
|
if ($driverUpdated || $carUpdated) {
|
|
jsonSuccess(null, "Driver & Car updated successfully");
|
|
} else {
|
|
jsonError("No changes were applied");
|
|
}
|