← All changes | app/Services/Intergrations/FluentFormIntegration/Bootstrap.php +45 -6 2.0.12 → 2.2.0 View file →

		@@ -11,8 +11,9 @@
11	11	use FluentBoards\App\Services\NotificationService;
12	12	use FluentBoards\App\Services\TaskService;
13	13	use FluentBoardsPro\App\Models\TaskAttachment;
14	14	use FluentForm\App\Http\Controllers\IntegrationManagerController;
	15	+use FluentForm\App\Modules\Acl\Acl;
15	16	use FluentBoards\Framework\Support\Arr;
16	17	use FluentBoards\App\Models\Board;
17	18	use FluentBoards\App\Models\Task;
18	19	use FluentBoards\App\Services\Helper;
		@@ -100,8 +101,11 @@
100	101	'enabled' => true
101	102	];
102	103	}
103	104
	105	+ /**
	106	+ * Build the Fluent Forms feed fields with a form-scoped board options URL.
	107	+ */
104	108	public function getSettingsFields($settings, $formId)
105	109	{
106	110	$data = [
107	111	'fields' => [
		@@ -144,9 +148,12 @@
144	148	'type' => 'select',
145	149	'placeholder' => 'Priority'
146	150	]
147	151	],
148		- 'remote_url' => admin_url('admin-ajax.php?action=fluentform_fluent_board_config')
	152	+ 'remote_url' => add_query_arg([
	153	+ 'action' => 'fluentform_fluent_board_config',
	154	+ 'form_id' => absint($formId)
	155	+ ], admin_url('admin-ajax.php'))
149	156	],
150	157	[
151	158	'key' => 'task_title',
152	159	'label' => 'Task Title',
		@@ -232,17 +239,32 @@
232	239	return $data;
233	240	}
234	241
235	242
	243	+ /**
	244	+ * Return board configuration options to authorized Fluent Forms managers.
	245	+ */
236	246	public function getBoardConfigOptions()
237	247	{
238		- $requestInfo = $this->app->request->get('settings');
239		- $boardConfig = Arr::get($requestInfo, 'board_config');
	248	+ $formId = absint($this->app->request->get('form_id'));
	249	+ $nonceValid = check_ajax_referer('fluent_forms_admin_nonce', 'fluent_forms_admin_nonce', false);
240	250
241		- $boardId = Arr::get($boardConfig, 'board_id');
	251	+ if (!$nonceValid || !$formId || !Acl::hasPermission('fluentform_forms_manager', $formId)) {
	252	+ $this->sendBoardConfigForbidden();
	253	+ }
242	254
	255	+ $requestInfo = $this->app->request->get('settings', []);
	256	+ $boardConfig = Arr::get($requestInfo, 'board_config', []);
	257	+
	258	+ $boardId = absint(Arr::get($boardConfig, 'board_id'));
	259	+ $boards = $this->getBoards();
	260	+
	261	+ if ($boardId && !array_key_exists($boardId, $boards)) {
	262	+ $this->sendBoardConfigForbidden();
	263	+ }
	264	+
243	265	$data = [
244		- 'board_id' => $this->getBoards(),
	266	+ 'board_id' => $boards,
245	267	'stage_id' => [],
246	268	'board_label_id' => [],
247	269	'member_ids' => [],
248	270	'priority' => apply_filters('fluent_boards/task_priorities', (new AdminMenuHandler())->getDefaultPriorities()),
		@@ -258,11 +280,28 @@
258	280	'fields_options' => $data
259	281	], 200);
260	282	}
261	283
	284	+ /**
	285	+ * Send a consistent forbidden response for invalid board configuration requests.
	286	+ */
	287	+ private function sendBoardConfigForbidden()
	288	+ {
	289	+ wp_send_json_error([
	290	+ 'message' => __('You do not have permission to configure Fluent Boards for this form.', 'fluent-boards')
	291	+ ], 403);
	292	+ }
	293	+
	294	+ /**
	295	+ * Get active boards accessible to the current user.
	296	+ */
262	297	private function getBoards()
263	298	{
264		- $boards = Board::query()->whereNull('archived_at')->get()->toArray();
	299	+ $boards = Board::query()
	300	+ ->whereNull('archived_at')
	301	+ ->byAccessUser(get_current_user_id())
	302	+ ->get()
	303	+ ->toArray();
265	304
266	305	$formattedBoards = [];
267	306	foreach ($boards as $board) {
268	307	if (is_array($board)) {