| @@ -548,8 +548,18 @@ | ||
| 548 | 548 | } |
| 549 | 549 | |
| 550 | 550 | public function update(Request $request, $board_id) |
| 551 | 551 | { |
| 552 | + // Board identity (title/description) is manager-only. This action shares the | |
| 553 | + // `update` name with CommentController@update under the same policy group, so the | |
| 554 | + // guard lives here rather than in a SingleBoardPolicy::update() method that would | |
| 555 | + // also block ordinary members from editing their own comments. | |
| 556 | + if (!PermissionManager::isBoardManager(absint($board_id))) { | |
| 557 | + return $this->sendError([ | |
| 558 | + 'message' => __('You do not have permission to edit this board.', 'fluent-boards'), | |
| 559 | + ], 403); | |
| 560 | + } | |
| 561 | + | |
| 552 | 562 | $boardData = $this->boardSanitizeAndValidate($request->only(['title', 'description']), [ |
| 553 | 563 | 'title' => 'required|string', |
| 554 | 564 | 'description' => 'nullable|string', |
| 555 | 565 | ]); |
| @@ -803,15 +813,22 @@ | ||
| 803 | 813 | } |
| 804 | 814 | |
| 805 | 815 | public function addMembersInBoard(Request $request, $board_id) |
| 806 | 816 | { |
| 807 | - $memberId = $request->getSafe('memberId'); | |
| 808 | - $isViewerOnly = $request->getSafe('isViewerOnly'); | |
| 817 | + $memberId = $request->getSafe('memberId', 'intval'); | |
| 818 | + $isViewerOnly = $request->getSafe('isViewerOnly', 'sanitize_text_field'); | |
| 809 | 819 | $member = $this->boardService->addMembersInBoard($board_id, $memberId, $isViewerOnly); |
| 820 | + | |
| 821 | + if ($member === null) { | |
| 822 | + return $this->sendError([ | |
| 823 | + 'message' => __('User not found.', 'fluent-boards'), | |
| 824 | + ], 404); | |
| 825 | + } | |
| 826 | + | |
| 810 | 827 | if (!$member) { |
| 811 | 828 | return $this->sendError([ |
| 812 | 829 | 'message' => __('User already a member', 'fluent-boards'), |
| 813 | - ], 304); | |
| 830 | + ], 409); | |
| 814 | 831 | } |
| 815 | 832 | |
| 816 | 833 | |
| 817 | 834 | return [ |
| @@ -935,9 +952,9 @@ | ||
| 935 | 952 | 'reset' => true, |
| 936 | 953 | ]; |
| 937 | 954 | } elseif ($request->image_url) { |
| 938 | 955 | $backgroundData = $this->boardSanitizeAndValidate($request->all(), [ |
| 939 | - "id" => 'required', | |
| 956 | + 'id' => 'required|integer', | |
| 940 | 957 | 'image_url' => 'required|string|url', |
| 941 | 958 | ]); |
| 942 | 959 | } elseif ($request->color) { |
| 943 | 960 | $backgroundData = $this->boardSanitizeAndValidate($request->all(), [ |
