• Mahmoud Aglan's avatar
    fix(registration): prevent double form-fee charge + NID-swap exploit + profile actions · db92e175
    Mahmoud Aglan authored
    Critical fixes:
    - submitFormPayment() now checks sa_players.registration_fee_paid as
      a safety net before creating any payment request
    - startRegistration() member_id fallback only used when NID matches
      the member's actual national_id (prevents NID-swap fee bypass)
    - lookupPlayer() validates NID-to-member consistency before proceeding
    - Existing registration lookup now includes 'pending_payment' status
    - Frontend clears membership_number when NID is manually changed
      after auto-fill
    
    Feature:
    - Player profile page now shows "Print Form" and "Generate Card"
      buttons for completing registration steps outside the wizard
    Co-Authored-By: 's avatarClaude Opus 4.6 <noreply@anthropic.com>
    db92e175
Name
Last commit
Last update
..
academies Loading commit data...
activities Loading commit data...
assessment Loading commit data...
assignments Loading commit data...
attendance Loading commit data...
bookings Loading commit data...
cards Loading commit data...
coaches Loading commit data...
disciplines Loading commit data...
facilities Loading commit data...
games Loading commit data...
gate Loading commit data...
groups Loading commit data...
institutions Loading commit data...
locker-rentals Loading commit data...
lockers Loading commit data...
makeup-sessions Loading commit data...
mirror Loading commit data...
players Loading commit data...
pool-grid Loading commit data...
pool-tickets Loading commit data...
pricing Loading commit data...
programs Loading commit data...
registration Loading commit data...
schedule Loading commit data...
service-desk Loading commit data...
subscriptions Loading commit data...
swimming Loading commit data...
training-attendance Loading commit data...
waitlist Loading commit data...
dashboard.php Loading commit data...