From bdd0bd6afa7973e695e5ff9034dfdbeb319f649b Mon Sep 17 00:00:00 2001
From: Myron Blair <myron@orbishosting.com>
Date: Sun, 5 Jul 2026 15:23:33 +0000
Subject: [PATCH] Require admin auth on api/search-customers.php

Was callable anonymously, leaking customer email/phone/wallet balance/reward
points to anyone who could guess a search term. Gated behind AdminAuth,
matching the pattern used elsewhere (401 JSON response, not a redirect,
since this is an API endpoint called via fetch from admin/pos.php).
---
 api/search-customers.php | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/api/search-customers.php b/api/search-customers.php
index 5b60376..be49bc6 100644
--- a/api/search-customers.php
+++ b/api/search-customers.php
@@ -6,6 +6,11 @@
 header('Content-Type: application/json');
 
 require_once __DIR__ . '/../includes/functions.php';
+require_once __DIR__ . '/../includes/auth.php';
+
+if (!AdminAuth::isLoggedIn()) {
+    jsonResponse(['error' => 'Unauthorized'], 401);
+}
 
 $query = $_GET['q'] ?? '';