status create

index.php

@@ -6,7 +6,7 @@ require_once "sql.php";
 
 function check_api_key()
 {
-  if (!check_table_field("Api-Key", "api_keys", "key"))
+  if (check_table_field("Api-Key", "api_keys", "key") === false)
     error(401, "Bad API key");
 }
 

status.php

@@ -3,8 +3,10 @@ require_once "utils.php";
 
 function check_token()
 {
-  if (!check_table_field("Authorization", "tokens", "token"))
+  $token = check_table_field("Authorization", "tokens", "token");
+  if ($token === false)
     error(401, "Invalid token");
+  return $token;
 }
 
 function status_confirm($id)
@@ -14,8 +16,29 @@ function status_confirm($id)
 
 function status_create()
 {
-  check_token();
+  $token = check_token();
   $status = get_post("status");
+  if (strlen($status) < 10)
+    error(422, "Status too short");
+  $latitude = get_post("latitude", false);
+  $longitude = get_post("longitude", false);
+  $u = database_exec("SELECT `id`, `username` FROM users WHERE `id` = ".
+    "(SELECT `user` FROM tokens WHERE `token` = :token)",
+    array(":token" => $token))->fetch();
+  database_exec("INSERT INTO status (`status`, `user`) VALUES(:status, :user)",
+    array(":status" => $status, ":user" => $u["id"]));
+  $s = database_exec("SELECT * FROM status WHERE id = :id",
+    array(":id" => database_get()->lastInsertId()))->fetch();
+  echo json_encode(array("status" => $s["status"],
+    "creation_date" => $s['date'],
+    /*"nb_confirm_up" => intval($s["up"]),
+    "nb_confirm_down" => intval($s["down"]),*/
+    "latitude" => $s["latitude"] === null ? null : floatval($s["latitude"]),
+    "longitude" => $s["longitude"] === null ? null : floatval($s["longitude"]),
+    "media_url" => $s["media"],
+    "id" => $s["id"],
+    "user_id" => $u["id"]
+  ));
 }
 
 function status_feed()

utils.php

@@ -33,9 +33,11 @@ function check_table_field($header, $table, $field)
   $headers = apache_request_headers();
   if (!isset($headers[$header]))
     return false;
-  return database_exec("SELECT id FROM $table WHERE `$field` = :data",
-    array(":data" => $headers[$header]))-> fetch()
-    !== false;
+  $u = database_exec("SELECT id FROM $table WHERE `$field` = :data",
+    array(":data" => $headers[$header]))->fetch();
+  if (!$u)
+    return false;
+  return $headers[$header];
 }
 
 ?>