Update: 2026-07-13 22:23:21

backend/transit/trip/stop_passengers.php

@@ -4,10 +4,21 @@
 
 require_once __DIR__ . '/../../transit/connect_app.php';
 
+if ($transit_user_role !== 'driver') jsonError('Only drivers can access this endpoint', 403);
+
 $stopId = (int)filterRequest('stop_id');
 if (!$stopId) jsonError('Missing stop_id', 400);
 
-// 1. تحقق من السائق ورحلته
+// استخرج سجل السائق من JWT — لا نثق بأي معرّف سائق من العميل
+$driverRow = $transit_con->prepare(
+    "SELECT id FROM transit_drivers WHERE main_driver_id=? AND status='active' LIMIT 1"
+);
+$driverRow->execute([(string)$transit_user_id]);
+$driverRec = $driverRow->fetch();
+if (!$driverRec) jsonError('Driver not found or not active', 403);
+$transit_driver_id = (int)$driverRec['id'];
+
+// 1. تحقق من رحلة السائق
 $stTrip = $transit_con->prepare(
     "SELECT id, org_id FROM transit_trips WHERE driver_id=? AND status='started' LIMIT 1"
 );