| @@ -350,8 +350,10 @@ | ||
| 350 | 350 | if (!empty($backgroundData)) { |
| 351 | 351 | $boardData['background'] = $backgroundData; |
| 352 | 352 | } |
| 353 | 353 | |
| 354 | + $this->validateRequestedLabelPresets($request->get('labels')); | |
| 355 | + | |
| 354 | 356 | $board = $this->boardService->createBoard($boardData); |
| 355 | 357 | $this->createBoardLabelsFromRequest($request, $board->id); |
| 356 | 358 | $this->addBoardMembersFromRequest($request, $board->id); |
| 357 | 359 | $type = ucfirst($boardData['type']); |
| @@ -445,20 +447,53 @@ | ||
| 445 | 447 | |
| 446 | 448 | foreach ($labels as $label) { |
| 447 | 449 | $labelData = Helper::sanitizeLabel((array) $label); |
| 448 | 450 | |
| 449 | - if (empty($labelData['label']) && empty($labelData['bg_color'])) { | |
| 451 | + if (empty($labelData['label']) && empty($labelData['bg_color']) && empty($labelData['color_preset'])) { | |
| 450 | 452 | continue; |
| 451 | 453 | } |
| 452 | 454 | |
| 453 | - $this->labelService->createLabel([ | |
| 455 | + $labelPayload = [ | |
| 454 | 456 | 'label' => $labelData['label'] ?? '', |
| 455 | 457 | 'bg_color' => $labelData['bg_color'] ?? '#f3f4f6', |
| 456 | 458 | 'color' => $labelData['color'] ?? '#1B2533', |
| 457 | - ], $boardId); | |
| 459 | + ]; | |
| 460 | + | |
| 461 | + if (array_key_exists('color_preset', $labelData)) { | |
| 462 | + $labelPayload['color_preset'] = $labelData['color_preset']; | |
| 463 | + } | |
| 464 | + | |
| 465 | + $this->labelService->createLabel($labelPayload, $boardId); | |
| 458 | 466 | } |
| 459 | 467 | } |
| 460 | 468 | |
| 469 | + /** | |
| 470 | + * Reject unsupported label preset ids before creating any board records. | |
| 471 | + * | |
| 472 | + * @param mixed $labels | |
| 473 | + * @return void | |
| 474 | + * @throws \Exception | |
| 475 | + */ | |
| 476 | + private function validateRequestedLabelPresets($labels) | |
| 477 | + { | |
| 478 | + if (!is_array($labels)) { | |
| 479 | + return; | |
| 480 | + } | |
| 481 | + | |
| 482 | + foreach ($labels as $label) { | |
| 483 | + $labelData = Helper::sanitizeLabel((array) $label); | |
| 484 | + $presetId = $labelData[Constant::LABEL_COLOR_PRESET_SETTING] ?? null; | |
| 485 | + | |
| 486 | + if ($presetId === null || $presetId === '') { | |
| 487 | + continue; | |
| 488 | + } | |
| 489 | + | |
| 490 | + if (!is_string($presetId) || !Constant::getLabelColorPreset($presetId)) { | |
| 491 | + throw new \Exception(esc_html__('Invalid label color preset', 'fluent-boards')); | |
| 492 | + } | |
| 493 | + } | |
| 494 | + } | |
| 495 | + | |
| 461 | 496 | private function addBoardMembersFromRequest(Request $request, $boardId) |
| 462 | 497 | { |
| 463 | 498 | $memberIds = $request->get('member_ids'); |
| 464 | 499 | |
| @@ -532,8 +567,9 @@ | ||
| 532 | 567 | $this->boardService->updateRecentBoards($board_id); |
| 533 | 568 | |
| 534 | 569 | $board->labelColor = Constant::TRELLO_COLOR_MAP; |
| 535 | 570 | $board->labelColorText = Constant::TEXT_COLOR_MAP; |
| 571 | + $board->labelColorPresets = Constant::LABEL_COLOR_PRESETS; | |
| 536 | 572 | |
| 537 | 573 | $board->users = Helper::sanitizeUserCollections($board->users); |
| 538 | 574 | $board->owner = Helper::sanitizeUserCollections($board->owner); |
| 539 | 575 | |
| @@ -548,8 +584,18 @@ | ||
| 548 | 584 | } |
| 549 | 585 | |
| 550 | 586 | public function update(Request $request, $board_id) |
| 551 | 587 | { |
| 588 | + // Board identity (title/description) is manager-only. This action shares the | |
| 589 | + // `update` name with CommentController@update under the same policy group, so the | |
| 590 | + // guard lives here rather than in a SingleBoardPolicy::update() method that would | |
| 591 | + // also block ordinary members from editing their own comments. | |
| 592 | + if (!PermissionManager::isBoardManager(absint($board_id))) { | |
| 593 | + return $this->sendError([ | |
| 594 | + 'message' => __('You do not have permission to edit this board.', 'fluent-boards'), | |
| 595 | + ], 403); | |
| 596 | + } | |
| 597 | + | |
| 552 | 598 | $boardData = $this->boardSanitizeAndValidate($request->only(['title', 'description']), [ |
| 553 | 599 | 'title' => 'required|string', |
| 554 | 600 | 'description' => 'nullable|string', |
| 555 | 601 | ]); |
| @@ -712,9 +758,8 @@ | ||
| 712 | 758 | |
| 713 | 759 | $formattedUsers[] = [ |
| 714 | 760 | 'ID' => $user->ID, |
| 715 | 761 | 'display_name' => $name, |
| 716 | - 'user_login' => $user->user_login, | |
| 717 | 762 | 'email' => $user->user_email, |
| 718 | 763 | 'photo' => fluent_boards_user_avatar($user->user_email, $name), |
| 719 | 764 | 'role' => $this->boardUserRole($boardRelation), |
| 720 | 765 | 'is_super' => in_array($user->ID, $superAdminIds), |
| @@ -803,15 +848,22 @@ | ||
| 803 | 848 | } |
| 804 | 849 | |
| 805 | 850 | public function addMembersInBoard(Request $request, $board_id) |
| 806 | 851 | { |
| 807 | - $memberId = $request->getSafe('memberId'); | |
| 808 | - $isViewerOnly = $request->getSafe('isViewerOnly'); | |
| 852 | + $memberId = $request->getSafe('memberId', 'intval'); | |
| 853 | + $isViewerOnly = $request->getSafe('isViewerOnly', 'sanitize_text_field'); | |
| 809 | 854 | $member = $this->boardService->addMembersInBoard($board_id, $memberId, $isViewerOnly); |
| 855 | + | |
| 856 | + if ($member === null) { | |
| 857 | + return $this->sendError([ | |
| 858 | + 'message' => __('User not found.', 'fluent-boards'), | |
| 859 | + ], 404); | |
| 860 | + } | |
| 861 | + | |
| 810 | 862 | if (!$member) { |
| 811 | 863 | return $this->sendError([ |
| 812 | 864 | 'message' => __('User already a member', 'fluent-boards'), |
| 813 | - ], 304); | |
| 865 | + ], 409); | |
| 814 | 866 | } |
| 815 | 867 | |
| 816 | 868 | |
| 817 | 869 | return [ |
| @@ -935,9 +987,9 @@ | ||
| 935 | 987 | 'reset' => true, |
| 936 | 988 | ]; |
| 937 | 989 | } elseif ($request->image_url) { |
| 938 | 990 | $backgroundData = $this->boardSanitizeAndValidate($request->all(), [ |
| 939 | - "id" => 'required', | |
| 991 | + 'id' => 'required|integer', | |
| 940 | 992 | 'image_url' => 'required|string|url', |
| 941 | 993 | ]); |
| 942 | 994 | } elseif ($request->color) { |
| 943 | 995 | $backgroundData = $this->boardSanitizeAndValidate($request->all(), [ |
