← All changes | app/Http/Controllers/PublicBoardController.php +9 -3 1.95.3 → 2.1.0 View file →

		@@ -4,8 +4,9 @@
4	4
5	5	use FluentBoards\App\Models\Board;
6	6	use FluentBoards\App\Models\Stage;
7	7	use FluentBoards\App\Models\Task;
	8	+use FluentBoards\App\Services\DescriptionMarkdownConverter;
8	9	use FluentBoards\App\Services\PublicAccessService;
9	10	use FluentBoards\Framework\Http\Request\Request;
10	11
11	12	class PublicBoardController extends Controller
		@@ -15,13 +16,14 @@
15	16	$board_id = absint($board_id);
16	17	$board = Board::findOrFail($board_id);
17	18
18	19	$board->background = maybe_unserialize($board->background);
19		- $board->description = wp_kses_post($board->description ?? '');
	20	+ $board->description = DescriptionMarkdownConverter::normalize($board->description);
20	21	$board->createdOn = $board->created_at ? $board->created_at->format('Y-m-d') : null;
21	22	$board->load(['stages', 'labels', 'users']);
22	23
23		- $board->users = PublicAccessService::sanitizeUsers($board->users);
	24	+ // Members must never be serialized from the User relation; replace it with the reduced list.
	25	+ PublicAccessService::replaceUserRelation($board, 'users');
24	26	$board->isUserOnlyViewer = true;
25	27	$board->is_pinned = false;
26	28
27	29	$board->makeHidden([
		@@ -28,8 +30,10 @@
28	30	'settings', 'currency', 'crm_contact_id',
29	31	'updated_at', 'created_by',
30	32	]);
31	33
	34	+ PublicAccessService::stripUserRelations($board);
	35	+
32	36	return [
33	37	'board' => $board
34	38	];
35	39	}
		@@ -261,8 +265,10 @@
261	265	$task->is_watching = false;
262	266	$task->contact = null;
263	267	$task->notifications = [];
264	268	$task->watchers = [];
265		- $task->assignees = PublicAccessService::sanitizeUsers($task->assignees);
	269	+ // Assignees must never be serialized from the User relation; replace it with the reduced list.
	270	+ PublicAccessService::replaceUserRelation($task, 'assignees');
	271	+ PublicAccessService::stripUserRelations($task);
266	272	}
267	273	}
268	274	}