• Mahmoud Aglan's avatar
    fix(registration): prevent double form-fee charge + NID-swap exploit + profile actions · db92e175
    Mahmoud Aglan authored
    Critical fixes:
    - submitFormPayment() now checks sa_players.registration_fee_paid as
      a safety net before creating any payment request
    - startRegistration() member_id fallback only used when NID matches
      the member's actual national_id (prevents NID-swap fee bypass)
    - lookupPlayer() validates NID-to-member consistency before proceeding
    - Existing registration lookup now includes 'pending_payment' status
    - Frontend clears membership_number when NID is manually changed
      after auto-fill
    
    Feature:
    - Player profile page now shows "Print Form" and "Generate Card"
      buttons for completing registration steps outside the wizard
    Co-Authored-By: 's avatarClaude Opus 4.6 <noreply@anthropic.com>
    db92e175
Name
Last commit
Last update
..
create.php Loading commit data...
documents.php Loading commit data...
edit.php Loading commit data...
index.php Loading commit data...
show.php Loading commit data...