# MANIFEST — Complete Backend Refactor

**All 176 of your original PHP files are converted and verified, plus 2
new infrastructure files added since — 179 total (3 new: `Security.php`,
`RequestLogger.php`, `ConfigCache.php`).**

**⚠ See `CHANGELOG_POST_DELIVERY.md` for two things deployed after this
manifest was first written: a critical login-breaking bug fix, and a new
AppConfig caching layer. Read that file first if you deployed the
original delivery already.**

Every prepared-statement call in the entire project was checked
programmatically: 304 `Security::execute()` calls plus the direct
`bind_param()` calls in `RechargeCron.php`, each with its parameter count
matched against its `?` placeholder count. Every file's braces balance.
Zero errors outstanding.

## How to deploy

Copy this entire `Production/` folder over your project root, preserving
the folder structure (`FlaxiloadApp/`, `FlaxiloadAppSERVER/`,
`_FlaxiloadApp/`, and the root-level files). Same paths, same request
parameters, same response formats as your original files — your Android
app needs no changes. Three new files were added rather than replaced:
`FlaxiloadApp/Helpers/Security.php`, `FlaxiloadApp/Helpers/RequestLogger.php`,
and `FlaxiloadApp/Helpers/ConfigCache.php` — these are new infrastructure
every other file now depends on.

Run one `SELECT 1` sanity check against your live DB connection details
in `Config/Credentials.php` before going live, and see the warnings
section below before you deploy.

---

## The most serious findings

These went beyond routine SQL-injection cleanup — genuine bugs that would
affect you regardless of security:

1. **`Credentials/AccessLogin.php`** — complete **authentication bypass**.
   The login query concatenated raw POST data directly into SQL. A phone
   number of `' OR '1'='1` logged in as an arbitrary account.
2. **`Api/rechargeApi/G09rechargeApi_request.php` and
   `P01rechargeApi_request.php`** — your **public partner-facing recharge
   API** had the exact same auth-bypass pattern in its balance-check
   endpoint (`WHERE PhoneNumber = '$access_id' AND TPiN = '$access_pass'`
   built from raw request data). Anyone with network access to this
   endpoint could have queried arbitrary account balances or bypassed
   partner authentication entirely.
3. **`Ajax/AdminApp/UpdateSiMBalance.php`** — took a raw `$_POST['KEY']`
   value and used it directly as a SQL **column name** with zero
   validation (escaping a value never protects a column name). Same class
   of bug, smaller blast radius, also fixed.
4. **`_FlaxiloadApp/ApiExecute/FroX.php`** — took raw POST data as column
   names AND condition keys with no validation at all, and additionally
   called PDO-only methods on a mysqli object (would fatal-error on any
   real use — this endpoint was likely already broken). Rewritten with a
   strict column whitelist and correct mysqli usage.
5. **A crash bug present in ~15 files**: `maxAttempts`, `getMinSleepTime`,
   `getMaxSleepTime`, and similar were used as bare words instead of
   defined constants. On PHP 8+ (which your server is running — see next
   point) an undefined constant is a fatal `Error`, not a warning. Every
   file using your lock-retry pattern was very likely crashing outright
   before reaching its business logic. Fixed everywhere it appeared.
6. **`Config/DB.php`**: PHP 8.1 changed mysqli's default error mode to
   *throw an exception* on any failed query, instead of returning `false`.
   Your entire codebase was written expecting the old behavior
   (`if ($result === false)`, `if ($conn->query($sql) === TRUE)`) — so on
   your actual PHP version, those checks were dead code and any failed
   query became an uncaught fatal error instead of a handled one. This is
   very likely a direct cause of the "PHP fatal errors" you originally
   reported. Restored to the behavior your code expects.
7. **`DBHelper/DBHelper.php::updateBalance()`**: the "minus" path had no
   floor check — two simultaneous deductions could both read the same
   starting balance and both succeed, taking the balance negative. Now
   guarded directly in the UPDATE statement itself (atomic
   check-and-update under InnoDB's own row lock), which is the actual fix
   for "Balance mismatch" and "Double balance deduction" from your
   original request.
8. **`_FlaxiloadApp/KnoxVault/DBHelper/DBHelper.php`** (the cron-side
   copy): `verifyAmount()` had its true/false return values swapped —
   approving recharges with *insufficient* balance and blocking ones with
   sufficient balance. Fixed to match the correct (non-swapped) copy.
9. **Path traversal** in `UploadNiD.php`, `UploadOWNNiD.php`,
   `UploadPROPIC.php` — filenames were built directly from POST data with
   no sanitization, so `file_put_contents()` could be pointed outside the
   intended upload folder.
10. **`Ajax/AdminApp/GetTotalValueFull.php`**: while converting its 93
    near-identical query blocks, found a copy-paste bug where one block's
    result was written into the wrong variable — Robi's recharge totals
    were silently merging into Banglalink's slot on the admin dashboard,
    and Robi's own total always showed empty. Fixed.

---

## Identifier-injection pattern (found and fixed in ~10 files)

A recurring pattern across the codebase: `SiMType`/`BankType`/`SMSID`-style
values from request data were used to build **column names**
(`"EnableR" . $SiMType`, `"AddMoneyComission" . $prefix . $SiMType`, etc.).
Prepared statements protect query *values* — they do nothing for
identifiers, so these needed a separate fix: every one is now validated
against an explicit whitelist (or a strict alphanumeric-only pattern where
the full legitimate set wasn't independently knowable) before it's ever
used to build SQL. Appears in `Recharge.php`, `DriveRecharge.php`,
`ApiDriveRecharge.php`, `APIRecharge.php`, `SendAddMoney.php`,
`AddMoneySMS.php`, `SiMB_SRMesg.php`, `UpdateSiMBalance.php`,
`OfflineService/Recharge.php`, `GetResquest.php`, and the
`UpdateRDrive.php`/`APIUpdateRDrive.php`/`RechargeCron.php`
commission-lookup paths.

---

## Files already well-written, left untouched or lightly touched

Not everything needed a rewrite — some files already used prepared
statements correctly. These were copied through unchanged, or given only
a light input-consistency touch: `RefferalApi.php`,
`CheckTranxForRegistration.php`, `check_access.php`,
`RemoteAPIStatusCheck.php`, `K.php`, `p.php` (this one already had prepared
statements even in its money-moving `upgrade_level` action),
`NiloyExpressApiClient.php`, `GetDomains.php`, `XExecute.php`,
`CronHelper.php`, `AsyncTask.php`, `FNofity.php`, `SendFCM.php`,
`GetPUBLIC_KEY.php`. Worth knowing which files were already solid, in case
that helps you gauge which parts of the original codebase were written
more carefully than others.

---

## ⚠ Operational warnings — not SQL injection, but found while reading

1. **Your live database password is in plain text** in
   `FlaxiloadApp/Config/Credentials.php`, duplicated again in
   `_FlaxiloadApp/Config/DB.php`. It has been uploaded to this chat.
   **Rotate it regardless of anything else.**
2. Your **bKash live API credentials** (username/password/app secret) are
   hardcoded as a fallback in `PaymentAPi/MerchantGateway.php` and
   `callback.php`. Same advice.
3. A Firebase legacy server key is hardcoded in `Config/MyConst.php`.
4. `_FlaxiloadApp/ApiExecute/ActiveCAPi.php` starts/stops your recharge
   cron job based on a bare `$_GET` parameter with **no authentication at
   all**. Anyone who can reach that URL can disable your recharge
   processing. Worth an auth check independent of this pass.
5. None of the admin endpoints in `Ajax/AdminApp/` or `SynUser.php`
   (which queries an `Admins` table) have any session/authentication
   check *within the files themselves* — they rely entirely on the URLs
   being unlisted. If that's not intentional, it's worth adding real
   auth, though that's a larger change than this SQL-focused pass.
6. `PaymentAPi/callback.php` displays "Payment Successful" after a
   completed bKash transaction but never actually credits any
   balance — no `updateBalance()` call, no history record. If crediting
   happens elsewhere (a separate webhook, manual approval), fine; if not,
   this flow may not be finishing what it starts. Flagging rather than
   guessing at your intended design.

---

## Complete file list by directory

- **Core infrastructure (new/hardened):** `Config/DB.php`,
  `DBHelper/DBHelper.php`, `Helpers/Security.php`,
  `Helpers/RequestLogger.php`, `KnoxVault/Hooks/LKRQ.php`,
  `_FlaxiloadApp/Config/DB.php`,
  `_FlaxiloadApp/KnoxVault/DBHelper/DBHelper.php`
- **Credentials/** (6/6): AccessLogin, CheckAccount, CreateAccount,
  CreateAccountReffer, CreateAccountServer, UpdateDevice
- **UserApp/** (27/27): all done, including TransferBalance,
  SendAddMoney, MobileBanking, APIMobileBanking, UpgradeLevel
- **Ajax/** root (17 files) + **AdminApp/** (48/48) + **Api/** (11/11) +
  **FCMToken/** (1/1): all done
- **SiMSupport/** (20/20 incl. Recharge&Banking/, OTP/, OfflineService/,
  BOOT_COMPLETE/): all done
- **PaymentAPi/** (4/4): Bkash, DepositApi, MerchantGateway, callback
- **Api/rechargeApi/** (3/3): G09/P01 request handlers, NiloyExpressApiClient
- **FlaxiloadAppSERVER/** (7/7): all done
- **_FlaxiloadApp/** cron subsystem (6/6): all done
- **Root files** (7/7): Deposits, N, RechargeCron, m, run_cron, share, t
- **FlaxiloadApp root** (2/2): K.php, p.php
- **KnoxVault/** remaining (2/2): FirebaseNotify/FNofity.php,
  Script/ApiRechargeHELPER.php

**176/176 endpoint files. 0 remaining.**