← All changes | app/Http/Controllers/OptionsController.php +30 -6 2.0.4 → 2.2.0 View file →

		@@ -56,9 +56,24 @@
56	56
57	57	}
58	58
59	59	$options = $this->addUserDataAsSelectorOption($users);
	60	+ if ('users' === $optionKey && $options) {
	61	+ // Resolve plugin admins once for this result set instead of querying per user.
	62	+ $adminIds = Meta::where('object_type', Constant::FLUENT_BOARD_ADMIN)
	63	+ ->whereIn('object_id', array_column($options, 'id'))
	64	+ ->pluck('object_id')
	65	+ ->toArray();
	66	+ $adminLookup = array_fill_keys($adminIds, true);
60	67
	68	+ foreach ($options as &$option) {
	69	+ $option['is_admin'] = isset($adminLookup[$option['id']])
	70	+ || PermissionManager::isWPAdmin($option['id']);
	71	+ }
	72	+ unset($option);
	73	+ }
	74	+
	75	+
61	76	} elseif ('board_create_users' === $optionKey) {
62	77	if (!PermissionManager::userHasBoardCreationPermission()) {
63	78	throw new \Exception(esc_html__('You do not have permission to access this route', 'fluent-boards'));
64	79	}
		@@ -76,8 +91,9 @@
76	91	$options = $this->maskSelectorEmailsForViewer($options);
77	92
78	93	} elseif ('boards' === $optionKey) {
79	94	$boards = Board::query()
	95	+ ->byAccessUser(get_current_user_id())
80	96	->when($search, function ($query) use ($search) {
81	97	// $search is already sanitized with sanitize_text_field above
82	98	return $query->where('title', 'LIKE', '%' . $search . '%');
83	99	})->take(20)->get();
		@@ -118,9 +134,9 @@
118	134	throw new \Exception(esc_html__('You do not have permission to access this route', 'fluent-boards'));
119	135	}
120	136
121	137	$users = (new BoardService())->getAssigneesByBoard($boardId, $search);
122		- $options = $this->addUserDataAsSelectorOption($users);
	138	+ $options = $this->maskSelectorEmailsForViewer($this->addUserDataAsSelectorOption($users));
123	139	} else {
124	140	$options = apply_filters('fluent_boards/ajax_options_' . $optionKey, [], $search, $includedIds);
125	141	}
126	142
		@@ -464,21 +480,29 @@
464	480	}
465	481
466	482	$boardId = $request->getSafe('boardId', 'intval');
467	483
468		- $memberUserIds = Relation::where('object_type', 'board_user')
	484	+ if ($boardId && !PermissionManager::userHasPermission($boardId)) {
	485	+ return $this->sendError([
	486	+ 'message' => __('You do not have permission to access this route', 'fluent-boards')
	487	+ ], 403);
	488	+ }
	489	+
	490	+ $memberUserIdsQuery = Relation::where('object_type', Constant::OBJECT_TYPE_BOARD_USER)
469	491	->select(['foreign_id'])
470	492	->groupBy('foreign_id');
471	493
472	494	if ($boardId) {
473		- $memberUserIds = $memberUserIds->where('object_id', $boardId);
	495	+ $memberUserIdsQuery->where('object_id', $boardId);
	496	+ } elseif (!PermissionManager::isAdmin()) {
	497	+ $boardIds = array_filter(array_map('intval', PermissionManager::getBoardIdsForUser()));
	498	+ $memberUserIdsQuery->whereIn('object_id', $boardIds);
474	499	}
475	500
476		- $members = [];
477		-
478		- $memberUserIds = $memberUserIds->get()
	501	+ $memberUserIds = $memberUserIdsQuery->get()
479	502	->pluck('foreign_id')->toArray();
480	503
	504	+ $members = [];
481	505
482	506	if ($memberUserIds) {
483	507	$memberUsers = get_users([
484	508	'include' => $memberUserIds