SWDB/application/action/Rate_Team_Action.php

<?php
/**
 * File for the team score modification action.
 *
 * Implements an action function to be called from the {@see Controller}.
 *
 * @author Iñigo Valentin <i@inigovalentin.com>
 * @license https://www.gnu.org/licenses/gpl-3.0.en.html GNU General Public License V3
 * @package SWDB
 */

require_once(PATH::ACTION . "Action.php");

/**
 * Sets the score for a team.
 *
 * Reads the POST parameters looking for the following KEYS:
 *  player: Owner's player ID.
 *  team: Team ID.
 *  score: New score.
 * Validates the data and sets the score.
 *
 * @category Action
 */
class Rate_Team_Action extends Action{
    
    /**
     * Executes the action.
     */
    function execute(){
        $player_id = filter_input(INPUT_GET, "player");
        $statement = get_context()->get_db()->prepare("
            SELECT count(user) AS c FROM player WHERE id = :player AND user = :user");
        $statement->bindValue(":player", $player_id, SQLITE3_TEXT);
        $statement->bindValue(":user", get_context()->get_user()->get_id(), SQLITE3_TEXT);
        if ($statement->execute()->fetchArray(SQLITE3_ASSOC)["c"] != 1){
            // The user doesn't own the team.
            $this->code = 401;
            $this->message = "Unauthorized.";
            return;
        }
        $team = filter_input(INPUT_GET, "team");
        $score = intval(filter_input(INPUT_GET, "score"));
        $statement = get_context()->get_db()->prepare("
          UPDATE team
          SET score = :score
          WHERE
            player = :player AND
            id = :team;
        ");
        $statement->bindValue(":score", $score, SQLITE3_TEXT);
        $statement->bindValue(":player", $player_id, SQLITE3_TEXT);
        $statement->bindValue(":team", $team, SQLITE3_TEXT);
        $statement->execute();
        $this->code = 204;
        $this->message = "No content";
        return;
    }
}