hamed/clinicpro
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add JSON files for security audit and test data

Browse Source 
- Created a JSON file for the security audit report dated 2026-07-19, detailing various security findings and their relationships.
- Added a JSON file for seed test data, including user creation logic and dependencies in the `seed_testdata.php` file.
- Introduced a JSON file for the AdminCspSubscriberTest, outlining test cases and their structure in the `AdminCspSubscriberTest.php`.
This commit is contained in:
hamed
2026-07-23 15:12:37 +03:30
parent 9a776be13c
commit 0edaf6518f
17 changed files with 2085 additions and 1687 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Appointment/Controller/MyAppointmentsController.php
+18 -7
View File
@@ -212,8 +212,8 @@ class MyAppointmentsController extends BaseController
}
/**
* Booking-scoped patient lookup by mobile. Lets the booking form search an
* existing patient before asking for national code / name. Unlike
* Booking-scoped patient lookup by mobile OR national code. Lets the booking
* form search an existing patient before asking for national code / name. Unlike
* /patient/search-user this is not gated by the patient_records feature and
* allows ROLE_ADMIN, because booking must work regardless of subscription.
*/
@@ -226,17 +226,28 @@ class MyAppointmentsController extends BaseController
return $this->error(ErrorCodes::FORBIDDEN, 'دسترسی ندارید', 403);
}
$mobile = InputValidator::toEnglishDigits(trim((string) $request->query->get('mobile', '')));
if (!InputValidator::isValidIranMobile($mobile)) {
return $this->error(ErrorCodes::VALIDATION, 'شماره موبایل نامعتبر است', 422, 'mobile');
// Lookup by mobile OR national code — the booking form lets the user
// search either way. National code takes precedence when both are sent.
$mobile = InputValidator::toEnglishDigits(trim((string) $request->query->get('mobile', '')));
$nationalQuery = InputValidator::toEnglishDigits(trim((string) $request->query->get('national_code', '')));
if ($nationalQuery !== '') {
if (!InputValidator::isValidIranNationalCode($nationalQuery)) {
return $this->error(ErrorCodes::VALIDATION, 'کد ملی نامعتبر است', 422, 'national_code');
}
// National code lives on the profile (profiles.national_code), not on User.
$profile = $this->profileRepo->findOneByNationalCode($nationalQuery);
$patient = $profile?->getUser();
} elseif (InputValidator::isValidIranMobile($mobile)) {
$patient = $this->userRepo->findByMobile($mobile);
} else {
return $this->error(ErrorCodes::VALIDATION, 'شماره موبایل یا کد ملی نامعتبر است', 422, 'mobile');
}
$patient = $this->userRepo->findByMobile($mobile);
if ($patient === null) {
return $this->success(['found' => false]);
}
// National code lives on the profile (profiles.national_code), not on User.
$nationalCode = $this->profileRepo->findByUser($patient)?->getNationalCode();
return $this->success([