myron/tomsjavajive
1
0
Fork 0
mirror of https://github.com/myronblair/tomsjavajive synced 2026-07-28 01:02:35 -05:00
Code Issues Packages Projects Releases Wiki Activity

Require admin auth on api/search-customers.php

Browse Source 
Was callable anonymously, leaking customer email/phone/wallet balance/reward
points to anyone who could guess a search term. Gated behind AdminAuth,
matching the pattern used elsewhere (401 JSON response, not a redirect,
since this is an API endpoint called via fetch from admin/pos.php).
This commit is contained in:
Myron Blair
2026-07-05 15:23:33 +00:00
parent 9771d53b19
commit bdd0bd6afa
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/search-customers.php
+5
View File
@@ -6,6 +6,11 @@
header('Content-Type: application/json'); header('Content-Type: application/json');
require_once __DIR__ . '/../includes/functions.php'; require_once __DIR__ . '/../includes/functions.php';
require_once __DIR__ . '/../includes/auth.php';
if (!AdminAuth::isLoggedIn()) {
jsonResponse(['error' => 'Unauthorized'], 401);
}
$query = $_GET['q'] ?? ''; $query = $_GET['q'] ?? '';