Hamza-AyedandClaude Opus 5
2135edcf43
- Customer-service notes joined to the account by comparing encrypted phone columns. Both notes tables now carry phone_key, written when a note is saved, and the three joins match on it. - The email_verifications join was comparing a plaintext column against an encrypted one, so it never matched and `verified` was always NULL in both passenger and driver sign-in. It is now resolved in PHP against the decrypted address, which fixes a pre-existing bug rather than only preparing for GCM. - auth/sendVerifyEmail.php built all three of its statements by interpolating the request values into SQL. Any caller could inject through the email or token field. Now parameterised. - serviceapp/register.php duplicate detection consults the users indexes and writes them with the row. Sweep confirms no join or lookup compares two encrypted columns any more. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
43 lines
1.2 KiB
PHP
43 lines
1.2 KiB
PHP
<?php
|
|
|
|
require_once __DIR__ . '/../connect.php';
|
|
|
|
// Retrieve and sanitize input parameters
|
|
$phone = filterRequest("phone");
|
|
$note = filterRequest("note");
|
|
$editor = filterRequest("editor");
|
|
|
|
// Encrypt the phone number
|
|
$encryptedPhone = $encryptionHelper->encryptData($phone);
|
|
// مفتاح الربط بالحساب — نفس صيغة otpPhoneKey المستعملة في phone_key
|
|
$phoneKey = otpPhoneKey($phone);
|
|
|
|
// SQL query: insert new row OR update existing one if phone already exists
|
|
$sql = "INSERT INTO `notesForDriverService` (`phone`, `phone_key`, `note`, `editor`)
|
|
VALUES (:phone, :phone_key, :note, :editor)
|
|
ON DUPLICATE KEY UPDATE
|
|
`note` = VALUES(`note`),
|
|
`editor` = VALUES(`editor`)";
|
|
|
|
// Prepare the SQL statement
|
|
$stmt = $con->prepare($sql);
|
|
|
|
// Bind the parameters
|
|
$stmt->bindParam(':phone', $encryptedPhone);
|
|
$stmt->bindParam(':phone_key', $phoneKey);
|
|
$stmt->bindParam(':note', $note);
|
|
$stmt->bindParam(':editor', $editor);
|
|
|
|
// Execute the query
|
|
$success = $stmt->execute();
|
|
|
|
if ($success) {
|
|
if ($stmt->rowCount() > 0) {
|
|
jsonSuccess(null, "Note inserted/updated successfully");
|
|
} else {
|
|
jsonError("No changes were made");
|
|
}
|
|
} else {
|
|
jsonError("Database error");
|
|
}
|
|
?>
|