| @@ -159,9 +159,9 @@ | ||
| 159 | 159 | { |
| 160 | 160 | $data = self::formatBoardSummary($board); |
| 161 | 161 | $data['stages'] = self::formatStageList($board->stages ?? []); |
| 162 | 162 | $data['labels'] = self::formatLabelList($board->labels ?? []); |
| 163 | - $data['members'] = self::formatUserList($board->users ?? []); | |
| 163 | + $data['members'] = self::formatUserList($board->users ?? [], $board->id); | |
| 164 | 164 | |
| 165 | 165 | if ($includeTasks) { |
| 166 | 166 | $tasks = Task::with(['stage', 'labels', 'assignees']) |
| 167 | 167 | ->where('board_id', $board->id) |
| @@ -199,9 +199,9 @@ | ||
| 199 | 199 | 'created_at' => self::toIso8601($task->created_at), |
| 200 | 200 | 'updated_at' => self::toIso8601($task->updated_at), |
| 201 | 201 | 'stage' => $task->stage ? self::formatStage($task->stage) : null, |
| 202 | 202 | 'labels' => self::formatLabelList($task->labels ?? []), |
| 203 | - 'assignees' => self::formatUserList($task->assignees ?? []), | |
| 203 | + 'assignees' => self::formatUserList($task->assignees ?? [], $task->board_id), | |
| 204 | 204 | ]; |
| 205 | 205 | } |
| 206 | 206 | |
| 207 | 207 | public static function formatTask($task) |
| @@ -209,9 +209,9 @@ | ||
| 209 | 209 | $data = self::formatTaskSummary($task); |
| 210 | 210 | $data['description'] = self::descriptionToMarkdown($task->description); |
| 211 | 211 | $data['settings'] = $task->settings; |
| 212 | 212 | $data['board'] = $task->board ? self::formatBoardSummary($task->board) : null; |
| 213 | - $data['watchers'] = self::formatUserList($task->watchers ?? []); | |
| 213 | + $data['watchers'] = self::formatUserList($task->watchers ?? [], $task->board_id); | |
| 214 | 214 | $data['comments'] = self::formatCommentList(self::limitItems($task->comments ?? [], self::TASK_HISTORY_LIMIT)); |
| 215 | 215 | $data['comments_limited_to'] = self::TASK_HISTORY_LIMIT; |
| 216 | 216 | $data['activities'] = self::formatActivityList(self::limitItems($task->activities ?? [], self::TASK_HISTORY_LIMIT)); |
| 217 | 217 | $data['activities_limited_to'] = self::TASK_HISTORY_LIMIT; |
| @@ -265,8 +265,12 @@ | ||
| 265 | 265 | 'title' => $label->title, |
| 266 | 266 | 'slug' => $label->slug, |
| 267 | 267 | 'color' => $label->color, |
| 268 | 268 | 'bg_color' => $label->bg_color, |
| 269 | + 'color_preset' => \FluentBoards\Framework\Support\Arr::get( | |
| 270 | + (array) $label->settings, | |
| 271 | + \FluentBoards\App\Services\Constant::LABEL_COLOR_PRESET_SETTING | |
| 272 | + ), | |
| 269 | 273 | 'position' => isset($label->position) ? (float) $label->position : null, |
| 270 | 274 | 'archived_at' => self::toIso8601($label->archived_at), |
| 271 | 275 | ]; |
| 272 | 276 | } |
| @@ -272,9 +276,9 @@ | ||
| 272 | 276 | } |
| 273 | 277 | return $items; |
| 274 | 278 | } |
| 275 | 279 | |
| 276 | - public static function formatUserList($users) | |
| 280 | + public static function formatUserList($users, $boardId) | |
| 277 | 281 | { |
| 278 | 282 | $items = []; |
| 279 | 283 | foreach ($users as $user) { |
| 280 | 284 | $name = trim((string) ($user->display_name ?? '')); |
| @@ -285,12 +289,31 @@ | ||
| 285 | 289 | $items[] = [ |
| 286 | 290 | 'id' => isset($user->ID) ? (int) $user->ID : (int) ($user->id ?? 0), |
| 287 | 291 | 'display_name' => $name, |
| 288 | 292 | 'email' => $user->user_email ?? '', |
| 289 | - 'avatar' => !empty($user->user_email) ? fluent_boards_user_avatar($user->user_email, $name) : '', | |
| 293 | + 'avatar' => '', | |
| 290 | 294 | ]; |
| 291 | 295 | } |
| 292 | - return $items; | |
| 296 | + // Reuse the board permission lookup across user lists in this request. | |
| 297 | + static $boardManagerResults = []; | |
| 298 | + $isBoardManager = null; | |
| 299 | + if (!current_user_can('list_users')) { | |
| 300 | + $cacheKey = get_current_blog_id() . ':' . get_current_user_id() . ':' . (int) $boardId; | |
| 301 | + if (!array_key_exists($cacheKey, $boardManagerResults)) { | |
| 302 | + $boardManagerResults[$cacheKey] = PermissionManager::isBoardManager($boardId); | |
| 303 | + } | |
| 304 | + $isBoardManager = $boardManagerResults[$cacheKey]; | |
| 305 | + } | |
| 306 | + $sanitizedItems = Helper::sanitizeUsersArray($items, $boardId, $isBoardManager); | |
| 307 | + foreach ($sanitizedItems as $index => &$item) { | |
| 308 | + // Only generate avatars when the policy permits disclosure of the email. | |
| 309 | + if ($item['email'] !== '' && $item['email'] === $items[$index]['email']) { | |
| 310 | + $item['avatar'] = fluent_boards_user_avatar($item['email'], $item['display_name']); | |
| 311 | + } | |
| 312 | + } | |
| 313 | + unset($item); | |
| 314 | + | |
| 315 | + return $sanitizedItems; | |
| 293 | 316 | } |
| 294 | 317 | |
| 295 | 318 | public static function formatCommentList($comments) |
| 296 | 319 | { |
