Code Coverage
 
Lines
Functions and Methods
Classes and Traits
Total
100.00%
35 / 35
100.00%
2 / 2
 CRAP
100.00%
1 / 1
VotingController
100.00%
35 / 35
100.00%
2 / 2
 14
100.00%
1 / 1
 __construct
100.00%
1 / 1
100.00%
1 / 1
 1
 create
100.00%
34 / 34
100.00%
1 / 1
 13
1<?php
2
3/**
4 * The Voting Controller
5 *
6 * This Source Code Form is subject to the terms of the Mozilla Public License,
7 * v. 2.0. If a copy of the MPL was not distributed with this file, You can
8 * obtain one at https://mozilla.org/MPL/2.0/.
9 *
10 * @package   phpMyFAQ
11 * @author    Thorsten Rinne <thorsten@phpmyfaq.de>
12 * @copyright 2024-2026 phpMyFAQ Team
13 * @license   https://www.mozilla.org/MPL/2.0/ Mozilla Public License Version 2.0
14 * @link      https://www.phpmyfaq.de
15 * @since     2024-03-03
16 */
17
18declare(strict_types=1);
19
20namespace phpMyFAQ\Controller\Frontend\Api;
21
22use Exception;
23use phpMyFAQ\Controller\AbstractController;
24use phpMyFAQ\Entity\Vote;
25use phpMyFAQ\Filter;
26use phpMyFAQ\Rating;
27use phpMyFAQ\Translation;
28use phpMyFAQ\User\UserSession;
29use Symfony\Component\HttpFoundation\JsonResponse;
30use Symfony\Component\HttpFoundation\Request;
31use Symfony\Component\HttpFoundation\Response;
32use Symfony\Component\Routing\Attribute\Route;
33
34final class VotingController extends AbstractController
35{
36    public function __construct(
37        private readonly Rating $rating,
38        private readonly UserSession $userSession,
39    ) {
40        parent::__construct();
41    }
42
43    /**
44     * @throws Exception
45     */
46    #[Route(path: 'voting', name: 'api.public.voting.create', methods: ['POST'])]
47    public function create(Request $request): JsonResponse
48    {
49        $this->userSession->setCurrentUser($this->currentUser);
50
51        $data = json_decode($request->getContent());
52
53        if (!$data instanceof \stdClass) {
54            throw new Exception('Invalid JSON data');
55        }
56
57        $csrfToken = Filter::filterVar($data->csrfToken ?? '', FILTER_SANITIZE_SPECIAL_CHARS, '');
58
59        if (!$this->verifySessionCsrfToken('voting', $csrfToken)) {
60            return $this->json(['error' => Translation::get(key: 'ad_msg_noauth')], Response::HTTP_UNAUTHORIZED);
61        }
62
63        if (!property_exists($data, 'value')) {
64            throw new Exception('Missing vote value');
65        }
66
67        if (!property_exists($data, 'id')) {
68            throw new Exception('Missing FAQ ID');
69        }
70
71        $faqId = Filter::filterVar($data->id ?? null, FILTER_VALIDATE_INT, 0);
72        $vote = Filter::filterVar($data->value, FILTER_VALIDATE_INT);
73        $filteredIp = Filter::filterVar($request->server->get('REMOTE_ADDR'), FILTER_VALIDATE_IP);
74        $userIp = is_string($filteredIp) ? $filteredIp : '';
75
76        if ($faqId <= 0) {
77            throw new Exception('Missing FAQ ID');
78        }
79
80        if ($vote === null || $vote < 1 || $vote > 5) {
81            throw new Exception('Invalid vote value');
82        }
83
84        if (!$this->rating->check($faqId, $userIp)) {
85            $this->userSession->userTracking('error_save_voting', $faqId);
86            return $this->json(['error' => Translation::get(key: 'err_VoteTooMuch')], Response::HTTP_BAD_REQUEST);
87        }
88
89        $this->userSession->userTracking('save_voting', $faqId);
90
91        $votingData = new Vote();
92        $votingData->setFaqId($faqId)->setVote($vote)->setIp($userIp);
93
94        $numberOfVotings = $this->rating->getNumberOfVotings($faqId);
95        if ($numberOfVotings === 0) {
96            $this->rating->create($votingData);
97        }
98
99        if ($numberOfVotings !== 0) {
100            $this->rating->update($votingData);
101        }
102
103        return $this->json([
104            'success' => Translation::get(key: 'msgVoteThanks'),
105            'rating' => $this->rating->get($faqId),
106        ], Response::HTTP_OK);
107    }
108}