# MSORGVTU Security Patch Report

## Important deployment note
The old source-code database credentials were removed. Before deploying, create a private `.env` file outside `public_html` using `public_html/.env.example` as the template.

## Completed code changes

1. Removed public SQL dumps, logs, generated API response files, and zip backups from `public_html`.
2. Added root `public_html/.htaccess` to force HTTPS, block sensitive file types, disable directory listing, prevent PHP execution in uploads, and add security headers.
3. Added `core/security.php` with secure session handling, security headers, JSON auth enforcement, prepared-statement helpers, password/PIN hashing helpers, server-side pricing helpers, and transaction-safe wallet functions.
4. Rebuilt `core/conn.php` and `assets/conn.php` to read credentials from environment variables instead of hardcoded source-code credentials.
5. Added `public_html/.env.example` for rotated database, SMTP, Monnify, Paystack, Flutterwave, and VTU API credentials.
6. Patched customer login to use prepared statements, support old hashes temporarily, rehash passwords on successful login, and regenerate the session ID.
7. Patched admin login to support old plaintext admin password temporarily, rehash on successful login, and regenerate the session ID.
8. Patched registration, user password reset, user password change, and admin password change to store new passwords with `password_hash()`.
9. Patched transaction PIN creation, verification, and change to use `password_hash()` / `password_verify()` and to stop accepting account password as a PIN substitute.
10. Added authenticated-session checks to every JSON endpoint in `assets/*.php`.
11. Stopped trusting browser-submitted user IDs in AJAX endpoints by replacing submitted IDs with the logged-in session user ID.
12. Stopped trusting browser-submitted data-plan, airtime, and cable prices by recalculating prices server-side from database tables.
13. Converted the main wallet movement operations to database transactions with row locks: wallet transfer, referral bonus conversion, wallet funding credits, and successful purchases.
14. Rebuilt payment verification for Paystack, Flutterwave, and Monnify to verify provider response/status, reduce duplicate credits, and credit wallet once per transaction reference.
15. Fixed PHP syntax errors in `assets/buydatanon.php`, `real-admin/change.php`, and `vtu/print.php`.
16. Replaced malformed CDN links like `../../cdnjs.cloudflare.com/...` with `https://cdnjs.cloudflare.com/...`.
17. Removed Monnify/autobank response logging to public text files.
18. Added `PRIVATE_DEPLOYMENT/security_hardening.sql` for database schema hardening.

## Manual actions still required

These cannot be performed inside the zip without access to your hosting, database, and payment-provider dashboards:

1. Create new database user/password in cPanel or your database host.
2. Generate/rotate Monnify, Paystack, Flutterwave, SMTP, and VTU API keys in their dashboards.
3. Put the new values in a private `.env` file outside `public_html`.
4. Run `PRIVATE_DEPLOYMENT/security_hardening.sql` on a backed-up staging database first.
5. Test login, registration, PIN creation/change, data purchase, airtime purchase, cable purchase, transfer, Paystack funding, Flutterwave funding, and Monnify webhook on staging before production.

## Verification performed

All PHP files in the patched project were checked with `php -l`; no PHP syntax errors remain.

## Remaining SQL review file
A residual dynamic SQL review file is included at `PRIVATE_DEPLOYMENT/remaining_dynamic_sql_review.tsv`.
The highest-risk public/AJAX/payment/auth paths were patched, but the legacy admin CRUD area still contains many old dynamic SQL statements. Those should be refactored next before treating the whole codebase as fully modernized.