128 lines
4.1 KiB
PHP
128 lines
4.1 KiB
PHP
<?php
|
|
require_once __DIR__ . '/../connect.php';
|
|
|
|
// هذه النقطة تُرجع بيانات ركّاب مفكوكة التشفير (هاتف، بريد، تاريخ ميلاد،
|
|
// هاتف طوارئ، وتوكن إشعارات). لم يكن فيها أي فحص للدور، و connect.php لا
|
|
// يفرض بوّابة عامة على مسار /Admin — أي أن أي مستخدم يملك JWT صالحاً، بما
|
|
// فيه راكب عادي، كان يستطيع سحب هذه البيانات كاملة.
|
|
if ($role !== 'admin' && $role !== 'super_admin') {
|
|
http_response_code(403);
|
|
echo json_encode([
|
|
'status' => 'failure',
|
|
'message' => 'Forbidden. Admin access required.',
|
|
], JSON_UNESCAPED_UNICODE);
|
|
exit;
|
|
}
|
|
|
|
$sql = "SELECT
|
|
`passengers`.`id`,
|
|
`passengers`.`phone`,
|
|
`passengers`.`email`,
|
|
`passengers`.`gender`,
|
|
`passengers`.`status`,
|
|
`passengers`.`birthdate`,
|
|
`passengers`.`site`,
|
|
`passengers`.`first_name`,
|
|
`passengers`.`last_name`,
|
|
`passengers`.`sosPhone`,
|
|
`passengers`.`education`,
|
|
`passengers`.`employmentType`,
|
|
`passengers`.`maritalStatus`,
|
|
`passengers`.`created_at`,
|
|
`passengers`.`updated_at`,
|
|
(
|
|
SELECT COUNT(`id`) FROM `passengers`
|
|
) AS countPassenger,
|
|
(
|
|
SELECT COUNT(`id`) FROM `feedBack`
|
|
) AS countFeedback,
|
|
(
|
|
SELECT CAST(AVG(`rating`) AS DECIMAL(10,2))
|
|
FROM `ratingPassenger`
|
|
WHERE `passenger_id` = `passengers`.`id`
|
|
) AS ratingPassenger,
|
|
(
|
|
SELECT COUNT(`driverID`)
|
|
FROM `ratingPassenger`
|
|
WHERE `passenger_id` = `passengers`.`id`
|
|
) AS countDriverRate,
|
|
(
|
|
SELECT COUNT(`passengerID`)
|
|
FROM `canecl`
|
|
WHERE `passengerID` = `passengers`.`id`
|
|
) AS countPassengerCancel,
|
|
(
|
|
SELECT CAST(AVG(`rating`) AS DECIMAL(10,2))
|
|
FROM `ratingDriver`
|
|
WHERE `passenger_iD` = `passengers`.`id`
|
|
) AS passengerAverageRating,
|
|
(
|
|
SELECT COUNT(`driver_id`)
|
|
FROM `ratingDriver`
|
|
WHERE `passenger_id` = `passengers`.`id`
|
|
) AS countPassengerRate,
|
|
(
|
|
SELECT COUNT(`ride`.`passenger_id`)
|
|
FROM `ride`
|
|
WHERE `ride`.`passenger_id` = `passengers`.`id`
|
|
) AS countPassengerRide,
|
|
(
|
|
SELECT `token`
|
|
FROM `tokens`
|
|
WHERE `tokens`.`passengerID` = `passengers`.`id`
|
|
) AS passengerToken
|
|
FROM
|
|
`passengers`
|
|
GROUP BY
|
|
`passengers`.`id`
|
|
ORDER BY
|
|
countPassengerRide DESC
|
|
LIMIT 10";
|
|
|
|
$stmt = $con->prepare($sql);
|
|
$stmt->execute();
|
|
$result = $stmt->fetchAll(PDO::FETCH_ASSOC);
|
|
|
|
// ✅ فك التشفير للحقول الحساسة
|
|
foreach ($result as &$row) {
|
|
$fieldsToDecrypt = [
|
|
"phone", "email", "gender", "birthdate", "site",
|
|
"first_name", "last_name", "sosPhone",
|
|
"education", "employmentType", "maritalStatus", "passengerToken"
|
|
];
|
|
|
|
foreach ($fieldsToDecrypt as $field) {
|
|
if (isset($row[$field]) && $row[$field] !== null) {
|
|
$decrypted = $encryptionHelper->decryptData($row[$field]);
|
|
if ($decrypted !== false) {
|
|
$row[$field] = $decrypted;
|
|
} else {
|
|
// سجل أو تجاهل القيم التي فشل فك تشفيرها
|
|
$row[$field] = null; // أو احتفظ بالقيمة المشفرة
|
|
error_log("Failed to decrypt field '$field' for passenger ID: " . $row['id']);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
unset($row);
|
|
|
|
// نموذج الصلاحيات: `super_admin` وحده يرى الرقم كاملاً، و`admin` يراقب برقم
|
|
// مُخفى جزئياً. توكن الإشعارات لا تعرضه الواجهة إطلاقاً ولا حاجة لإرساله —
|
|
// تسريبه يتيح انتحال إشعارات موجّهة لراكب بعينه.
|
|
$isSuperAdmin = ($role === 'super_admin');
|
|
foreach ($result as &$row) {
|
|
unset($row['passengerToken']);
|
|
|
|
if (!$isSuperAdmin) {
|
|
if (isset($row['phone'])) $row['phone'] = maskPhone($row['phone']);
|
|
if (isset($row['sosPhone'])) $row['sosPhone'] = maskPhone($row['sosPhone']);
|
|
}
|
|
}
|
|
unset($row);
|
|
|
|
if ($stmt->rowCount() > 0) {
|
|
jsonSuccess($data = $result);
|
|
} else {
|
|
jsonError("No records found");
|
|
}
|
|
?>
|