fix(security): patch critical security vulnerabilities

- Remove User::$guarded = [] to prevent mass assignment attacks
- Enable SQL strict mode and disable emulated prepares (SQL injection prevention)
- Switch password hashing from bcrypt to argon2id (stronger algorithm)
- Enable session encryption to protect session data at rest
- Restrict TrustProxies to localhost only (prevent IP spoofing)
- Restrict CORS allowed_methods via env variable instead of wildcard
- Add PayPal amount mismatch detection to prevent payment manipulation
- Add double-capture prevention (idempotency check)
- Add expected_amount column to transactions table for verification

This commit is contained in:

root

2026-05-19 19:37:15 +02:00

parent 05fc7b04bc

commit 7f59024bef

8 changed files with 56 additions and 14 deletions

									
										config/session.php
									
		+1
		-1
	
												View File
												
				@@ -46,7 +46,7 @@ return [

				    |

				    */

				    'encrypt' => false,

				    'encrypt' => env('SESSION_ENCRYPT', true),

				    /*

				    |--------------------------------------------------------------------------