Hamza-Ayed e51d266a0f Fix #17: SQL injection + mass data exposure (backend) ...

- Fixed SQL injection in ride/license/get.php (interpolated variable → parameterized query)
- Added admin role checks to all 3 mass data endpoints (driver tokens, passenger tokens, phones+tokens)
- Added pagination (50/page) to all 4 mass data endpoints
- Fixed LIMIT to use placeholders with type binding

2026-06-17 07:45:35 +03:00

..

Admin

Fix #17: SQL injection + mass data exposure (backend)

2026-06-17 07:45:35 +03:00

auth

fix(security): fix login AND logic to OR, add signup input validation, separate OTP rate limit keys

2026-06-17 07:05:58 +03:00

card_image

first commit

2026-06-09 08:40:31 +03:00

core

fix(security): fix SQL injection in updatePaymetToPaid, OTP random_int, static IV encryption, storage mismatch

2026-06-17 06:31:13 +03:00

driver_assurance

Update: 2026-06-12 20:40:40

2026-06-12 20:40:40 +03:00

EgyptDocuments

Update: 2026-06-16 17:47:17

2026-06-16 17:47:19 +03:00

email

Update: 2026-06-12 20:40:40

2026-06-12 20:40:40 +03:00

imageForUsingApp

first commit

2026-06-09 08:40:31 +03:00

instructions_web

first commit

2026-06-09 08:40:31 +03:00

migration

Update: 2026-06-16 01:17:28

2026-06-16 01:17:29 +03:00

new_driver_car

first commit

2026-06-09 08:40:31 +03:00

ride

Fix #17: SQL injection + mass data exposure (backend)

2026-06-17 07:45:35 +03:00

serviceapp

Update: 2026-06-16 01:17:28

2026-06-16 01:17:29 +03:00

webhook_sms

Update: 2026-06-12 20:40:40

2026-06-12 20:40:40 +03:00

.env.example

Update: 2026-06-16 17:47:17

2026-06-16 17:47:19 +03:00

.gitignore

Update: 2026-06-16 17:47:17

2026-06-16 17:47:19 +03:00

aggregate_files.py

Update: 2026-06-11 13:47:39

2026-06-11 13:47:40 +03:00

composer.json

Update: 2026-06-16 01:17:28

2026-06-16 01:17:29 +03:00

composer.lock

Update: 2026-06-12 20:40:40

2026-06-12 20:40:40 +03:00

connect.php

Update: 2026-06-16 01:17:28

2026-06-16 01:17:29 +03:00

driver_socket.php

Update: 2026-06-11 13:47:39

2026-06-11 13:47:40 +03:00

encrypt_decrypt.php

fix(security): fix SQL injection in updatePaymetToPaid, OTP random_int, static IV encryption, storage mismatch

2026-06-17 06:31:13 +03:00

functions.php

fix(security): wallet balance check with FOR UPDATE, remove user-supplied ID in signup, hardcoded IP to env

2026-06-17 06:53:00 +03:00

get_connect.php

first commit

2026-06-09 08:40:31 +03:00

ggg.php

first commit

2026-06-09 08:40:31 +03:00

git_push.sh

Update: 2026-06-12 20:40:40

2026-06-12 20:40:40 +03:00

intaleq_v1_secure_latest.md

Update: 2026-06-11 13:47:39

2026-06-11 13:47:40 +03:00

intaleq_v1.code-workspace

Update: 2026-06-11 13:47:39

2026-06-11 13:47:40 +03:00

invest_code.php

Update: 2026-06-11 13:47:39

2026-06-11 13:47:40 +03:00

load_env.php

Update: 2026-06-12 20:40:40

2026-06-12 20:40:40 +03:00

login.php

Update: 2026-06-16 01:17:28

2026-06-16 01:17:29 +03:00

loginAdmin.php

Update: 2026-06-16 01:17:28

2026-06-16 01:17:29 +03:00

loginFirstTime.php

Update: 2026-06-16 01:17:28

2026-06-16 01:17:29 +03:00

loginFirstTimeDriver.php

Update: 2026-06-16 01:17:28

2026-06-16 01:17:29 +03:00

loginJwtDriver.php

Update: 2026-06-16 01:17:28

2026-06-16 01:17:29 +03:00

loginJwtWalletDriver.php

Update: 2026-06-16 02:52:06

2026-06-16 02:52:06 +03:00

loginWallet.php

Update: 2026-06-16 01:17:28

2026-06-16 01:17:29 +03:00

logout.php

first commit

2026-06-09 08:40:31 +03:00

migrate_driver_passwords.php

Update: 2026-06-12 20:40:40

2026-06-12 20:40:40 +03:00

migration_create_table.php

Update: 2026-06-15 01:37:40

2026-06-15 01:37:41 +03:00

migration_referral_system.sql

Update: 2026-06-10 02:44:54

2026-06-10 02:44:55 +03:00

passenger_socket.php

Update: 2026-06-16 17:47:17

2026-06-16 17:47:19 +03:00

privacy_policy1.php

Update: 2026-06-12 20:40:40

2026-06-12 20:40:40 +03:00

privacy_policy.php

Update: 2026-06-12 20:40:40

2026-06-12 20:40:40 +03:00

schema_primary.sql

Update: 2026-06-16 01:17:28

2026-06-16 01:17:29 +03:00

schema_ride.sql

Update: 2026-06-15 01:37:40

2026-06-15 01:37:41 +03:00

schema_tracking.sql

Update: 2026-06-15 01:37:40

2026-06-15 01:37:41 +03:00

test_signed_pricing.php

Update: 2026-06-15 19:39:21

2026-06-15 19:39:21 +03:00

upload_audio.php

fix(security): fix host header injection in upload_audio, email header injection, add SSL verify to MTN curl

2026-06-17 06:57:56 +03:00

uploadImagePortrate.php

fix(security): fix pervasive IDOR - force JWT user identity in 9 endpoints, fix host injection, exception leaks, wallet auth

2026-06-17 06:22:41 +03:00