← All changes | app/Http/Policies/UserPolicy.php +48 -1 2.0.12 → 2.2.0 View file →

		@@ -15,9 +15,56 @@
15	15	*/
16	16	public function verifyRequest(Request $request)
17	17	{
18	18	// Check if user has access to the app
19		- return PermissionManager::hasAppAccess();
	19	+ if (!PermissionManager::hasAppAccess()) {
	20	+ return false;
	21	+ }
	22	+
	23	+ // Match the controller's URL target; query/body parameters must not override it.
	24	+ $routeParams = $request->get_url_params();
	25	+ if (!array_key_exists('id', $routeParams)) {
	26	+ return true;
	27	+ }
	28	+
	29	+ $targetUserId = intval($routeParams['id']);
	30	+
	31	+ return $targetUserId > 0 && PermissionManager::userCanAccessMemberProfile($targetUserId);
	32	+ }
	33	+
	34	+ /** Only an authenticated Fluent Boards user may change their own name. */
	35	+ public function updateDisplayName(Request $request)
	36	+ {
	37	+ $routeParams = $request->get_url_params();
	38	+ $currentUserId = get_current_user_id();
	39	+ return $currentUserId > 0
	40	+ && (int) ($routeParams['id'] ?? 0) === $currentUserId
	41	+ && PermissionManager::isFluentBoardsUser($currentUserId);
	42	+ }
	43	+
	44	+ /** Apply the same ownership check to profile photo uploads. */
	45	+ public function updateProfilePhoto(Request $request)
	46	+ {
	47	+ return $this->updateDisplayName($request);
	48	+ }
	49	+
	50	+ /** MCP connections are managed only by their owner. */
	51	+ public function getMcpConnections(Request $request)
	52	+ {
	53	+ $routeParams = $request->get_url_params();
	54	+ $currentUserId = get_current_user_id();
	55	+
	56	+ return $currentUserId > 0 && (int) ($routeParams['id'] ?? 0) === $currentUserId;
	57	+ }
	58	+
	59	+ public function createMcpConnection(Request $request)
	60	+ {
	61	+ return $this->getMcpConnections($request);
	62	+ }
	63	+
	64	+ public function revokeMcpConnection(Request $request)
	65	+ {
	66	+ return $this->getMcpConnections($request);
20	67	}
21	68
22	69	public function globalSearch(Request $request)
23	70	{