SHOPV5VIP - BAT DAU O DAY
=========================

BAN NAY DA DOI API THE:
https://naptaikhoan.com/chargingws/v2

1) CAU HINH DATABASE (moi shop mot file rieng)
------------------------------------------------
Mo file: private/database.php
Chi sua 3 dong:

'username' => 'TEN_USER_DB',
'password' => 'MAT_KHAU_DB_IT_NHAT_16_KY_TU',
'database' => 'TEN_DATABASE',

Vi du neu cPanel tao:
DB:   htnw_shop1
User: htnw_shop1user
Pass: mot-mat-khau-ngau-nhien-rat-dai

thi dien dung 3 gia tri do vao private/database.php.
Moi shop nen co DB user rieng va user do chi co quyen tren DB cua shop do.
Quyen khuyen nghi: private/ = 711, private/database.php = 600.
Khong xoa private/.htaccess.

2) DATABASE HIEN TAI
--------------------
Neu dang update website dang chay: KHONG can import lai toan bo DB.
Chi chay file sau mot lan trong phpMyAdmin:

database_patches/2026-08-24-card-api-naptaikhoan.sql

Neu cai shop moi: import database goc cua ban truoc, sau do chay migration tren.

3) CALLBACK THE
---------------
Dang nhap admin -> /cpanel/recharge/card/config
Copy dung dong "URL CALLBACK CARD (BAO MAT)" sang nha cung cap neu provider
khong ho tro custom header/HMAC.


4) KIEM TRA BAO MAT SAU KHI UPLOAD
----------------------------------
- Phai dung HTTPS.
- Mo /config.php truc tiep => phai 403.
- Mo /security/serverPrivate.pem => phai 403.
- Mo /composer.json => phai 403.
- /api/deposit/card => phai duoc route thang vao models/callback/card.php nhu source DA GAME.
- Callback card khong yeu cau security_token rieng cua lop guard.
- /cpanel/security => xem trang kiem tra trien khai.

5) LUU Y RSA
------------
Source ionCube co the phu thuoc cac RSA key trong /security, nen ban nay khong tu
xoa/doi key mu de tranh lam hong giao thuc. Web da chan HTTP vao /security.
Tuy nhien private key tung nam trong source phan phoi nen nen rotate sau khi ban
xac nhan ben nao dang dung public key tuong ung.

6) GIOI HAN KIEM TRA
--------------------
Mot phan core PHP bi ionCube. Co the gia co web server/gateway/config nhung khong
the xac minh day du SQL Injection, IDOR, race/double-spend, upload validation va
CSRF ben trong code da ma hoa. Khong nen coi bat ky source nao la "khong hack duoc".
