Complete security audit fixes

app/assets/utils/db_auth.php

@@ -3,18 +3,94 @@
 require_once __DIR__."/../../config.php";
 require_once __DIR__."/../../dbconn.php";
 
+
+/**
+ * Check PDO statement for errors
+ * Logs full error server-side, returns generic message to client
+ *
+ * @param PDOStatement $sth      - The executed PDO statement
+ * @param array        &$answer  - Response array passed by reference
+ * @param array        $options  - Optional settings:
+ *                                  'message'     => Custom client-facing error message
+ *                                  'log'         => Custom server log label
+ *                                  'code'        => HTTP response code (default: 500)
+ *                                  'before_exit' => Callback function before exit
+ *
+ * @example
+ * // Simple — use all defaults
+ * db_check($sth, $answer);
+ *
+ * @example
+ * // Custom client message
+ * db_check($sth, $answer, [
+ *     'message' => "Contact not found."
+ * ]);
+ *
+ * @example
+ * // Custom log label + message
+ * db_check($sth, $answer, [
+ *     'log'     => "Failed to fetch contact",
+ *     'message' => "Could not load contact. Please try again."
+ * ]);
+ *
+ * @example
+ * // Custom HTTP status code
+ * db_check($sth, $answer, [
+ *     'code'    => 403,
+ *     'message' => "Access denied."
+ * ]);
+ *
+ * @example
+ * // Cleanup callback before exit
+ * db_check($sth, $answer, [
+ *     'message'     => "Upload failed.",
+ *     'before_exit' => function() use ($tmp_file) {
+ *         if(file_exists($tmp_file)) unlink($tmp_file);
+ *     }
+ * ]);
+ */
+function db_check($sth, &$answer, $options = []) {
+    if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
+        
+        $trace = debug_backtrace()[0];
+        
+        $log_message = $options['log'] ?? "DB Error";
+        error_log($log_message . " in " . $trace['file'] . " line " . $trace['line'] . ": " . $sth->errorInfo()[2]);
+        
+        $answer["message"] = $options['message'] ?? "A server error occurred. Please try again.";
+        
+        http_response_code($options['code'] ?? 500);
+        
+        if(isset($options['before_exit'])) {
+            call_user_func($options['before_exit']);
+        }
+        
+        exit(json_encode($answer));
+    }
+}
+
+
+
 if(!empty($_SESSION["login_company_id"])){
 
+    // CSRF Validation — add right at the top of the logged-in block
+    if($_SERVER['REQUEST_METHOD'] === 'POST'){
+        $csrf_token = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
+        if(empty($csrf_token) || $csrf_token !== $_SESSION['csrf_token']){
+            http_response_code(403);
+            exit(json_encode(["message" => "Invalid request"]));
+        }
+    }
+
     // validate otp
     $sql = "SELECT `password`
         FROM user 
-        WHERE user_id = {$_SESSION["login_user_id"]}";
+        WHERE user_id = :company_id";
     $sth = $pdo1->prepare($sql);
-    $sth->execute();
-    if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
-        $answer["message"] = (empty($sth->errorInfo()[2])) ? $sth->errorInfo()[0] : $sth->errorInfo()[2];
-        exit(json_encode($answer));
-    }
+    $sth->execute([
+        ":company_id" => $_SESSION["login_user_id"]
+    ]);
+    db_check($sth, $answer);
     $password = $sth->fetchColumn();
     /** Generate OTP */
     function generateOTP($sercet_key, $time_step = 180, $length = 6){
@@ -35,13 +111,13 @@ if(!empty($_SESSION["login_company_id"])){
     }
     
     // check company accessibily
-    $sql = "SELECT * FROM company_map_user WHERE company_id = {$_SESSION["login_company_id"]} and user_id = {$_SESSION["login_user_id"]}";
+    $sql = "SELECT * FROM company_map_user WHERE company_id = :login_company_id and user_id = :login_user_id";
     $sth = $pdo1->prepare($sql);
-    $sth->execute();
-    if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
-        $answer["message"] = (empty($sth->errorInfo()[2])) ? $sth->errorInfo()[0] : $sth->errorInfo()[2];
-        exit(json_encode($answer));
-    }
+    $sth->execute([
+        ":login_company_id" => $_SESSION["login_company_id"],
+        ":login_user_id" => $_SESSION["login_user_id"]
+    ]);
+    db_check($sth, $answer);
     $map = $sth->fetchAll(PDO::FETCH_ASSOC);
     
     if( count($map)==0 ){
@@ -51,10 +127,6 @@ if(!empty($_SESSION["login_company_id"])){
 
 }
 
-
-
-
-
 // set up ANSWER
 $answer = array("success"=>0, "message"=>"");
 
@@ -86,10 +158,4 @@ if(!empty($_SESSION["login_company_id"])){
     );
 
 } 
-
-
-class db_auth{
-	
-
-}
 ?>

app/assets/utils/module/mailer.php

@@ -34,10 +34,12 @@ class mailer{
 			return $input["smtp"];
 		}
 
-		$sql = "SELECT * FROM smtp_setting WHERE company_id = '{$revise["company_id"]}'";
+		$sql = "SELECT * FROM smtp_setting WHERE company_id = :company_id ";
 
 		$sth = $this->pdo2->prepare("$sql");
-		$sth->execute();
+		$sth->execute([
+			":company_id" => $revise["company_id"]
+		]);
 
 		$res = $sth->fetch(PDO::FETCH_ASSOC);