| 1 |
<?php |
| 2 |
|
| 3 |
namespace FluentBoards\App\Http\Policies; |
| 4 |
|
| 5 |
use FluentBoards\Framework\Http\Request\Request; |
| 6 |
use FluentBoards\App\Services\PermissionManager; |
| 7 |
|
| 8 |
class BoardManagerPolicy extends BasePolicy |
| 9 |
{ |
| 10 |
/** |
| 11 |
* Require management access to the route or report board; only admins may omit it. |
| 12 |
* @param \FluentBoards\Framework\Http\Request\Request $request |
| 13 |
* @return bool |
| 14 |
*/ |
| 15 |
public function verifyRequest(Request $request) |
| 16 |
{ |
| 17 |
$routeParams = $request->get_url_params(); |
| 18 |
|
| 19 |
// Timesheet routes pass their board filter as an input, not a URL parameter. |
| 20 |
$boardId = $routeParams['board_id'] ?? $request->get('board_id', 0); |
| 21 |
$boardId = filter_var($boardId === '' ? 0 : $boardId, FILTER_VALIDATE_INT, [ |
| 22 |
'options' => ['min_range' => 0] |
| 23 |
]); |
| 24 |
|
| 25 |
return $boardId !== false && PermissionManager::isBoardManager($boardId); |
| 26 |
} |
| 27 |
} |
| 28 |
|
