Remittance API Security Enhancement

api/MoneyRequest.php

@@ -168,10 +168,34 @@ class MoneyRequest extends System {
             mkdir($this -> accessLogDir, 0777, true);
         }
         
+        $charvalidity = [
+            $this -> fromAccount,
+            $this -> toAccount
+        ];
+        
+        foreach($charvalidity as $checkaccnum){
+            if(!is_numeric($checkaccnum)){
+                $this -> result[PARAM_RESULT] = sprintf("%02d", VAL_INT_6);
+                $this -> result[PARAM_STATUS] = "CHARACTER_RESTRICTION";
+                $this -> result["desc"] = "account number must be numeric";
+                
+                goto ends;
+            }
+            
+            if(strlen($checkaccnum) > VAL_INT_8){
+                $this -> result[PARAM_RESULT] = sprintf("%02d", VAL_INT_6);
+                $this -> result[PARAM_STATUS] = "CHARACTER_LIMIT";
+                $this -> result["desc"] = "an account number must only have 8 digits";
+                
+                goto ends;
+            }
+        }
+        
         $requestDetails = [
             "IP_Address" => $this -> getColumnData($_SERVER, "REMOTE_ADDR"),
             "Program_Code" => $this -> pnum
         ];
+        
         $requestDetails = print_r(array_merge($requestDetails, apache_request_headers()), true);
         $this -> logDetails($requestDetails, VAL_INT_1);
         
@@ -225,6 +249,13 @@ class MoneyRequest extends System {
                 .$this -> amount;
                 
                 $sha = hash("sha256", $checkSignature);
+                                
+                if($apiUserAccount !== $this -> fromAccount){
+                    $this -> result[PARAM_RESULT] = sprintf("%02d", VAL_INT_4);
+                    $this -> result[PARAM_STATUS] = "SENDER_ERROR";
+                    
+                    goto ends;   
+                }
                 
                 if($this -> signature != $sha){
                     $this -> result["combination"] = [
@@ -236,14 +267,14 @@ class MoneyRequest extends System {
                     $this -> result[PARAM_STATUS] = "REJECTED";
                     
                     $this -> responseCode = 406;
-                }else{
+                }else{                    
                     $this -> randomSecondsDelay();
                     
                     $this -> ctransfer = $this -> checkTransfer(
-                        $this -> fromAccount, 
-                        $this -> toAccount, 
-                        $this -> currency, 
-                        $this -> amount, 
+                        $this -> fromAccount,
+                        $this -> toAccount,
+                        $this -> currency,
+                        $this -> amount,
                         $this -> debitCurrency);
                     
                     if($this -> ctransfer[PARAM_RESULT] == NO_COUNT){
@@ -265,6 +296,7 @@ class MoneyRequest extends System {
             $this -> responseCode = 406;
         }
         
+        ends:
         $this -> logPost($this -> pnum);
     }