mirror of
https://github.com/myronblair/tomsjavajive
synced 2026-07-27 16:52:36 -05:00
myron
186ac0cb6d
- admin/api/upload-splash.php had NO admin-auth check (included the public customer header, not admin/includes/header.php) and both upload endpoints trusted the client-supplied MIME type and filename extension, so an attacker could name a file "shell.php", spoof Content-Type: image/png, and get PHP written into a web-reachable uploads/ directory. Added AdminAuth check and centralized real-content validation (getimagesize + server-side extension mapping) in a new handleImageUpload() helper used by both admin/upload-image.php and admin/api/upload-splash.php. - Removed CURLOPT_SSL_VERIFYPEER => false from the CyberMail email calls in includes/email.php and includes/functions.php (MITM risk on the API key). Rewrote functions.php's sendEmail() as a thin wrapper around Email::send() so there's one implementation instead of two that could drift (this is what had the second copy of the TLS bypass). - Escaped customer-controlled fields (customer_name, tracking info, reset URL) before interpolating into outbound HTML emails — name is free text from registration/checkout with no length/char restriction, so it was stored-HTML-injectable into every transactional email. - Fixed api/redeem-gift-card.php referencing a nonexistent `balance` column on gift_cards (actual column is current_balance) — gift card redemption was completely broken, always returning "no remaining balance". - Fixed api/submit-review.php inserting into nonexistent `content`/`status` columns on reviews (actual columns are `comment`/`is_approved`) — review submission was crashing on every request. - Hardened .htaccess: block /db/*, /.git/*, and *.sql. Live site currently serves db/schema.sql and the full .git directory (including .git/config, which contains a GitHub PAT with push access) over HTTP — the existing config/includes RedirectMatch rules are also not being enforced live, see report for details; this needs a server-level fix too. - Cleaned up README's leftover install instructions pointing at a deleted create-admin.php with a documented default password. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
98 lines
2.8 KiB
PHP
98 lines
2.8 KiB
PHP
<?php
|
|
/**
|
|
* Tom's Java Jive - Redeem Gift Card API
|
|
*/
|
|
|
|
header('Content-Type: application/json');
|
|
|
|
require_once __DIR__ . '/../includes/functions.php';
|
|
require_once __DIR__ . '/../includes/auth.php';
|
|
|
|
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
|
|
jsonResponse(['error' => 'Method not allowed'], 405);
|
|
}
|
|
|
|
if (!CustomerAuth::isLoggedIn()) {
|
|
jsonResponse(['error' => 'Please log in to redeem a gift card'], 401);
|
|
}
|
|
|
|
$customer = CustomerAuth::getFullUser();
|
|
$input = json_decode(file_get_contents('php://input'), true);
|
|
|
|
$code = strtoupper(str_replace(['-', ' '], '', trim($input['code'] ?? '')));
|
|
|
|
if (empty($code) || strlen($code) < 8) {
|
|
jsonResponse(['error' => 'Invalid gift card code'], 400);
|
|
}
|
|
|
|
// Find gift card
|
|
$giftCard = db()->fetch(
|
|
"SELECT * FROM gift_cards WHERE code = :code AND is_active = 1",
|
|
['code' => $code]
|
|
);
|
|
|
|
if (!$giftCard) {
|
|
jsonResponse(['error' => 'Gift card not found or already used'], 404);
|
|
}
|
|
|
|
if ($giftCard['current_balance'] <= 0) {
|
|
jsonResponse(['error' => 'This gift card has no remaining balance'], 400);
|
|
}
|
|
|
|
if ($giftCard['expires_at'] && strtotime($giftCard['expires_at']) < time()) {
|
|
jsonResponse(['error' => 'This gift card has expired'], 400);
|
|
}
|
|
|
|
$amount = $giftCard['current_balance'];
|
|
|
|
try {
|
|
// Start transaction
|
|
db()->query("START TRANSACTION");
|
|
|
|
// Update gift card balance to 0
|
|
db()->query(
|
|
"UPDATE gift_cards SET current_balance = 0, is_active = 0, updated_at = NOW() WHERE gift_card_id = :id",
|
|
['id' => $giftCard['gift_card_id']]
|
|
);
|
|
|
|
// Log gift card transaction
|
|
db()->insert('gift_card_transactions', [
|
|
'gift_card_id' => $giftCard['gift_card_id'],
|
|
'amount' => -$amount,
|
|
'balance_after' => 0,
|
|
'type' => 'redeem',
|
|
'description' => 'Redeemed by customer: ' . $customer['email']
|
|
]);
|
|
|
|
// Add to customer wallet
|
|
$newWalletBalance = ($customer['wallet_balance'] ?? 0) + $amount;
|
|
|
|
db()->query(
|
|
"UPDATE customers SET wallet_balance = :balance, updated_at = NOW() WHERE customer_id = :id",
|
|
['balance' => $newWalletBalance, 'id' => $customer['customer_id']]
|
|
);
|
|
|
|
// Log wallet transaction
|
|
db()->insert('wallet_transactions', [
|
|
'transaction_id' => generateId('wt_'),
|
|
'customer_id' => $customer['customer_id'],
|
|
'amount' => $amount,
|
|
'balance_after' => $newWalletBalance,
|
|
'type' => 'gift_card',
|
|
'description' => 'Gift card redeemed: ' . $code
|
|
]);
|
|
|
|
db()->query("COMMIT");
|
|
|
|
jsonResponse([
|
|
'success' => true,
|
|
'amount' => $amount,
|
|
'new_balance' => $newWalletBalance,
|
|
'message' => formatCurrency($amount) . ' has been added to your wallet!'
|
|
]);
|
|
|
|
} catch (Exception $e) {
|
|
db()->query("ROLLBACK");
|
|
jsonResponse(['error' => 'Failed to redeem gift card. Please try again.'], 500);
|
|
}
|