← All changes | app/Http/Policies/BoardManagerPolicy.php +11 -4 2.0.0 → 2.2.0 View file →

		@@ -7,14 +7,21 @@
7	7
8	8	class BoardManagerPolicy extends BasePolicy
9	9	{
10	10	/**
11		- * Check user permission for any method
12		- * @param \FluentBoards\Framework\Request\Request $request
13		- * @param int $board_id
	11	+ * Require management access to the route or report board; only admins may omit it.
	12	+ * @param \FluentBoards\Framework\Http\Request\Request $request
14	13	* @return bool
15	14	*/
16	15	public function verifyRequest(Request $request)
17	16	{
18		- return PermissionManager::isBoardManager($request->board_id);
	17	+ $routeParams = $request->get_url_params();
	18	+
	19	+ // Timesheet routes pass their board filter as an input, not a URL parameter.
	20	+ $boardId = $routeParams['board_id'] ?? $request->get('board_id', 0);
	21	+ $boardId = filter_var($boardId === '' ? 0 : $boardId, FILTER_VALIDATE_INT, [
	22	+ 'options' => ['min_range' => 0]
	23	+ ]);
	24	+
	25	+ return $boardId !== false && PermissionManager::isBoardManager($boardId);
19	26	}
20	27	}