Myron Blair bdd0bd6afa Require admin auth on api/search-customers.php ...

Was callable anonymously, leaking customer email/phone/wallet balance/reward
points to anyone who could guess a search term. Gated behind AdminAuth,
matching the pattern used elsewhere (401 JSON response, not a redirect,
since this is an API endpoint called via fetch from admin/pos.php).

2026-07-05 15:23:33 +00:00

..

apply-wallet-credit.php

Wire up wallet balance and gift cards at checkout; fix Square gift card option; fix account/rewards.php CSS; fix real PDO/schema bugs found along the way

2026-07-05 14:53:47 +00:00

cart.php

Initial commit

2026-05-22 12:52:44 +00:00

create-square-payment.php

Add Square payment processor, gated behind PAYMENT_PROCESSOR flag (default: stripe)

2026-07-05 05:27:19 +00:00

delete-account.php

Initial commit

2026-05-22 12:52:44 +00:00

loyalty.php

Initial commit

2026-05-22 12:52:44 +00:00

orders.php

Initial commit

2026-05-22 12:52:44 +00:00

payment-status.php

Add Square payment processor, gated behind PAYMENT_PROCESSOR flag (default: stripe)

2026-07-05 05:27:19 +00:00

pos-order.php

Initial commit

2026-05-22 12:52:44 +00:00

products.php

Initial commit

2026-05-22 12:52:44 +00:00

push-subscribe.php

Initial commit

2026-05-22 12:52:44 +00:00

redeem-gift-card.php

Wire up wallet balance and gift cards at checkout; fix Square gift card option; fix account/rewards.php CSS; fix real PDO/schema bugs found along the way

2026-07-05 14:53:47 +00:00

search-customers.php

Require admin auth on api/search-customers.php

2026-07-05 15:23:33 +00:00

submit-review.php

security: fix unauthenticated file upload/RCE risk, TLS bypass, XSS, and broken gift-card/review columns

2026-07-04 14:22:50 -05:00

subscribe.php

Initial commit

2026-05-22 12:52:44 +00:00

test-notification.php

Switch email to CyberMail API; integrations page manages API key via DB

2026-05-29 18:49:15 +00:00

validate-coupon.php

Initial commit

2026-05-22 12:52:44 +00:00

webhook.php

Add Square payment processor, gated behind PAYMENT_PROCESSOR flag (default: stripe)

2026-07-05 05:27:19 +00:00

wishlist.php

Initial commit

2026-05-22 12:52:44 +00:00