| @@ -198,8 +198,9 @@ | ||
| 198 | 198 | { |
| 199 | 199 | $fieldMaps = [ |
| 200 | 200 | 'bg_color' => 'sanitize_text_field', |
| 201 | 201 | 'color' => 'sanitize_text_field', |
| 202 | + 'color_preset' => 'sanitize_key', | |
| 202 | 203 | 'label' => 'sanitize_text_field', |
| 203 | 204 | 'boardId' => 'intval', |
| 204 | 205 | 'task_id' => 'intval', |
| 205 | 206 | 'meta_value' => 'intval', |
| @@ -434,9 +435,10 @@ | ||
| 434 | 435 | |
| 435 | 436 | return $users; |
| 436 | 437 | } |
| 437 | 438 | |
| 438 | - public static function sanitizeUsersArray($users, $boardId = null) | |
| 439 | + // Callers formatting multiple lists may supply a resolved board-manager result. | |
| 440 | + public static function sanitizeUsersArray($users, $boardId = null, $isBoardManager = null) | |
| 439 | 441 | { |
| 440 | 442 | if (current_user_can('list_users')) { |
| 441 | 443 | return $users; |
| 442 | 444 | } |
| @@ -442,9 +444,9 @@ | ||
| 442 | 444 | } |
| 443 | 445 | |
| 444 | 446 | $sanitizedUsers = []; |
| 445 | 447 | |
| 446 | - if(!PermissionManager::isBoardManager($boardId)) //Todo: may create permission security issue, will be modified later | |
| 448 | + if (!($isBoardManager ?? PermissionManager::isBoardManager($boardId))) | |
| 447 | 449 | { |
| 448 | 450 | $currentUser = wp_get_current_user(); |
| 449 | 451 | if($currentUser && isset($currentUser->user_email)){ |
| 450 | 452 | $currentUserEmail = $currentUser->user_email; |
