mirror of
https://github.com/myronblair/tomsjavajive
synced 2026-07-28 09:12:36 -05:00
Myron Blair
bdd0bd6afa
Was callable anonymously, leaking customer email/phone/wallet balance/reward points to anyone who could guess a search term. Gated behind AdminAuth, matching the pattern used elsewhere (401 JSON response, not a redirect, since this is an API endpoint called via fetch from admin/pos.php).
31 lines
732 B
PHP
31 lines
732 B
PHP
<?php
|
|
/**
|
|
* Tom's Java Jive - Customer Search API
|
|
*/
|
|
|
|
header('Content-Type: application/json');
|
|
|
|
require_once __DIR__ . '/../includes/functions.php';
|
|
require_once __DIR__ . '/../includes/auth.php';
|
|
|
|
if (!AdminAuth::isLoggedIn()) {
|
|
jsonResponse(['error' => 'Unauthorized'], 401);
|
|
}
|
|
|
|
$query = $_GET['q'] ?? '';
|
|
|
|
if (strlen($query) < 2) {
|
|
jsonResponse([]);
|
|
}
|
|
|
|
$customers = db()->fetchAll(
|
|
"SELECT customer_id, email, name, phone, wallet_balance, reward_points
|
|
FROM customers
|
|
WHERE (email LIKE :q1 OR name LIKE :q2 OR phone LIKE :q3) AND is_active = 1
|
|
ORDER BY name ASC
|
|
LIMIT 20",
|
|
['q1' => '%' . $query . '%', 'q2' => '%' . $query . '%', 'q3' => '%' . $query . '%']
|
|
);
|
|
|
|
jsonResponse($customers);
|