Update: 2026-06-16 01:17:28

backend/ride/pricing/get.php

@@ -286,20 +286,23 @@ foreach ($categories as $key => $carType) {
 $priceToken = "";
 if (isset($encryptionHelper)) {
     $tokenPayload = [
-        'passenger_id' => $passenger_id,
+        'passenger_id'   => $passenger_id,
         'start_location' => $passengerLat . ',' . $passengerLng,
-        'end_location' => $destLat . ',' . $destLng,
-        'expires' => time() + 180, // Valid for 3 minutes
-        'prices' => $pricesRaw
+        'end_location'   => $destLat . ',' . $destLng,
+        // ✅ FIX R6: تضمين distance و duration في الـ token لمنع التلاعب
+        'distance'       => $distance,
+        'duration'       => $duration,
+        'expires'        => time() + 180, // Valid for 3 minutes
+        'prices'         => $pricesRaw
     ];
     $priceToken = $encryptionHelper->encryptData(json_encode($tokenPayload));
 }
 
 echo json_encode([
-    'status' => 'success',
-    'data' => $prices,
-    'price_token' => $priceToken,
-    'applied_discount' => $discount,
+    'status'                => 'success',
+    'data'                  => $prices,
+    'price_token'           => $priceToken,
+    'applied_discount'      => $discount,
     'added_negative_balance' => $negativeBalance
 ]);
 ?>