← All changes | app/Services/Intergrations/FluentFormIntegration/Bootstrap.php +47 -7 2.0.4 → 2.1.0 View file →

		@@ -6,12 +6,14 @@
6	6	use FluentBoards\App\Models\Label;
7	7	use FluentBoards\App\Models\Stage;
8	8	use FluentBoards\App\Models\User;
9	9	use FluentBoards\App\Services\Constant;
	10	+use FluentBoards\App\Services\DescriptionMarkdownConverter;
10	11	use FluentBoards\App\Services\NotificationService;
11	12	use FluentBoards\App\Services\TaskService;
12	13	use FluentBoardsPro\App\Models\TaskAttachment;
13	14	use FluentForm\App\Http\Controllers\IntegrationManagerController;
	15	+use FluentForm\App\Modules\Acl\Acl;
14	16	use FluentBoards\Framework\Support\Arr;
15	17	use FluentBoards\App\Models\Board;
16	18	use FluentBoards\App\Models\Task;
17	19	use FluentBoards\App\Services\Helper;
		@@ -99,8 +101,11 @@
99	101	'enabled' => true
100	102	];
101	103	}
102	104
	105	+ /**
	106	+ * Build the Fluent Forms feed fields with a form-scoped board options URL.
	107	+ */
103	108	public function getSettingsFields($settings, $formId)
104	109	{
105	110	$data = [
106	111	'fields' => [
		@@ -143,9 +148,12 @@
143	148	'type' => 'select',
144	149	'placeholder' => 'Priority'
145	150	]
146	151	],
147		- 'remote_url' => admin_url('admin-ajax.php?action=fluentform_fluent_board_config')
	152	+ 'remote_url' => add_query_arg([
	153	+ 'action' => 'fluentform_fluent_board_config',
	154	+ 'form_id' => absint($formId)
	155	+ ], admin_url('admin-ajax.php'))
148	156	],
149	157	[
150	158	'key' => 'task_title',
151	159	'label' => 'Task Title',
		@@ -231,17 +239,32 @@
231	239	return $data;
232	240	}
233	241
234	242
	243	+ /**
	244	+ * Return board configuration options to authorized Fluent Forms managers.
	245	+ */
235	246	public function getBoardConfigOptions()
236	247	{
237		- $requestInfo = $this->app->request->get('settings');
238		- $boardConfig = Arr::get($requestInfo, 'board_config');
	248	+ $formId = absint($this->app->request->get('form_id'));
	249	+ $nonceValid = check_ajax_referer('fluent_forms_admin_nonce', 'fluent_forms_admin_nonce', false);
239	250
240		- $boardId = Arr::get($boardConfig, 'board_id');
	251	+ if (!$nonceValid || !$formId || !Acl::hasPermission('fluentform_forms_manager', $formId)) {
	252	+ $this->sendBoardConfigForbidden();
	253	+ }
241	254
	255	+ $requestInfo = $this->app->request->get('settings', []);
	256	+ $boardConfig = Arr::get($requestInfo, 'board_config', []);
	257	+
	258	+ $boardId = absint(Arr::get($boardConfig, 'board_id'));
	259	+ $boards = $this->getBoards();
	260	+
	261	+ if ($boardId && !array_key_exists($boardId, $boards)) {
	262	+ $this->sendBoardConfigForbidden();
	263	+ }
	264	+
242	265	$data = [
243		- 'board_id' => $this->getBoards(),
	266	+ 'board_id' => $boards,
244	267	'stage_id' => [],
245	268	'board_label_id' => [],
246	269	'member_ids' => [],
247	270	'priority' => apply_filters('fluent_boards/task_priorities', (new AdminMenuHandler())->getDefaultPriorities()),
		@@ -257,11 +280,28 @@
257	280	'fields_options' => $data
258	281	], 200);
259	282	}
260	283
	284	+ /**
	285	+ * Send a consistent forbidden response for invalid board configuration requests.
	286	+ */
	287	+ private function sendBoardConfigForbidden()
	288	+ {
	289	+ wp_send_json_error([
	290	+ 'message' => __('You do not have permission to configure Fluent Boards for this form.', 'fluent-boards')
	291	+ ], 403);
	292	+ }
	293	+
	294	+ /**
	295	+ * Get active boards accessible to the current user.
	296	+ */
261	297	private function getBoards()
262	298	{
263		- $boards = Board::query()->whereNull('archived_at')->get()->toArray();
	299	+ $boards = Board::query()
	300	+ ->whereNull('archived_at')
	301	+ ->byAccessUser(get_current_user_id())
	302	+ ->get()
	303	+ ->toArray();
264	304
265	305	$formattedBoards = [];
266	306	foreach ($boards as $board) {
267	307	if (is_array($board)) {
		@@ -306,9 +346,9 @@
306	346	$stageId = Arr::get($feedData, 'board_config.stage_id');
307	347	$boardLabels = Arr::get($feedData, 'board_config.board_label_id');
308	348	$assignees = Arr::get($feedData, 'board_config.member_ids');
309	349	$priority = Arr::get($feedData, 'board_config.priority');
310		- $description = Arr::get($feedData, 'description');
	350	+ $description = DescriptionMarkdownConverter::normalize(Arr::get($feedData, 'description'));
311	351	$position = Arr::get($feedData, 'position');
312	352	$crmContactId = Arr::get($feedData, 'board_config.crm_contact_id');
313	353	$submitterName = trim(Arr::get($feedData, 'submitter_name'));
314	354	$submitterEmail = Arr::get($feedData, 'submitter_email');