83 lines
3.0 KiB
PHP
83 lines
3.0 KiB
PHP
<?php
|
|
require_once __DIR__ . '/../../connect.php';
|
|
|
|
// --- استقبال المتغيرات ---
|
|
// Force passenger_id from JWT — only passengers can rate drivers
|
|
if ($role !== 'passenger') {
|
|
jsonError("Only passengers can rate drivers");
|
|
exit;
|
|
}
|
|
$passenger_id = $user_id;
|
|
$driver_id = filterRequest("driver_id");
|
|
$ride_id = filterRequest("ride_id");
|
|
$rating = filterRequest("rating");
|
|
$comment = filterRequest("comment");
|
|
|
|
try {
|
|
// التحقق من صحة البيانات الأساسية قبل البدء
|
|
if (empty($passenger_id) || empty($driver_id) || empty($ride_id)) {
|
|
throw new Exception("Required fields are missing");
|
|
}
|
|
|
|
// 🔥 التحقق من ملكية الرحلة: يجب أن تخص هذا الراكب وهذا السائق فعلاً،
|
|
// وأن تكون منتهية، قبل قبول التقييم — يمنع تقييم رحلات عشوائية (IDOR).
|
|
$stmtRide = $con->prepare("SELECT driver_id, passenger_id, status FROM ride WHERE id = ?");
|
|
$stmtRide->execute([$ride_id]);
|
|
$ride = $stmtRide->fetch(PDO::FETCH_ASSOC);
|
|
|
|
if (!$ride) {
|
|
jsonError("Ride not found");
|
|
exit;
|
|
}
|
|
if ((string)$ride['passenger_id'] !== (string)$passenger_id) {
|
|
jsonError("This ride does not belong to you");
|
|
exit;
|
|
}
|
|
if ((string)$ride['driver_id'] !== (string)$driver_id) {
|
|
jsonError("Driver does not match this ride");
|
|
exit;
|
|
}
|
|
if ($ride['status'] !== 'Finished') {
|
|
jsonError("Ride must be finished before rating");
|
|
exit;
|
|
}
|
|
|
|
// 🔥 منع تكرار التقييم لنفس الرحلة من نفس الراكب
|
|
$stmtDup = $con->prepare("SELECT COUNT(*) FROM `ratingDriver` WHERE ride_id = ? AND passenger_id = ?");
|
|
$stmtDup->execute([$ride_id, $passenger_id]);
|
|
if ($stmtDup->fetchColumn() > 0) {
|
|
jsonError("This ride has already been rated");
|
|
exit;
|
|
}
|
|
|
|
$sql = "INSERT INTO `ratingDriver`(
|
|
`passenger_id`, `driver_id`, `ride_id`, `rating`, `comment`
|
|
) VALUES (
|
|
:passenger_id, :driver_id, :ride_id, :rating, :comment
|
|
)";
|
|
|
|
$stmt = $con->prepare($sql);
|
|
$stmt->bindParam(':passenger_id', $passenger_id);
|
|
$stmt->bindParam(':driver_id', $driver_id);
|
|
$stmt->bindParam(':ride_id', $ride_id);
|
|
$stmt->bindParam(':rating', $rating);
|
|
$stmt->bindParam(':comment', $comment);
|
|
|
|
$stmt->execute();
|
|
|
|
if ($stmt->rowCount() > 0) {
|
|
jsonSuccess(null, "Rate inserted successfully");
|
|
} else {
|
|
// في حال لم يتم الإدخال ولكن لم يحدث خطأ فني (نادرة الحدوث في Insert)
|
|
jsonError("Failed to save rating information");
|
|
}
|
|
|
|
} catch (PDOException $e) {
|
|
error_log("[addRateToDriver] DB Error: " . $e->getMessage() . " | RideID: $ride_id");
|
|
jsonError("Database Error: Could not save rating");
|
|
|
|
} catch (Exception $e) {
|
|
error_log("[addRateToDriver] General Error: " . $e->getMessage());
|
|
jsonError("Error: Could not save rating");
|
|
}
|
|
?>
|