| @@ -76,8 +76,9 @@ | ||
| 76 | 76 | $options = $this->maskSelectorEmailsForViewer($options); |
| 77 | 77 | |
| 78 | 78 | } elseif ('boards' === $optionKey) { |
| 79 | 79 | $boards = Board::query() |
| 80 | + ->byAccessUser(get_current_user_id()) | |
| 80 | 81 | ->when($search, function ($query) use ($search) { |
| 81 | 82 | // $search is already sanitized with sanitize_text_field above |
| 82 | 83 | return $query->where('title', 'LIKE', '%' . $search . '%'); |
| 83 | 84 | })->take(20)->get(); |
| @@ -464,21 +465,29 @@ | ||
| 464 | 465 | } |
| 465 | 466 | |
| 466 | 467 | $boardId = $request->getSafe('boardId', 'intval'); |
| 467 | 468 | |
| 468 | - $memberUserIds = Relation::where('object_type', 'board_user') | |
| 469 | + if ($boardId && !PermissionManager::userHasPermission($boardId)) { | |
| 470 | + return $this->sendError([ | |
| 471 | + 'message' => __('You do not have permission to access this route', 'fluent-boards') | |
| 472 | + ], 403); | |
| 473 | + } | |
| 474 | + | |
| 475 | + $memberUserIdsQuery = Relation::where('object_type', Constant::OBJECT_TYPE_BOARD_USER) | |
| 469 | 476 | ->select(['foreign_id']) |
| 470 | 477 | ->groupBy('foreign_id'); |
| 471 | 478 | |
| 472 | 479 | if ($boardId) { |
| 473 | - $memberUserIds = $memberUserIds->where('object_id', $boardId); | |
| 480 | + $memberUserIdsQuery->where('object_id', $boardId); | |
| 481 | + } elseif (!PermissionManager::isAdmin()) { | |
| 482 | + $boardIds = array_filter(array_map('intval', PermissionManager::getBoardIdsForUser())); | |
| 483 | + $memberUserIdsQuery->whereIn('object_id', $boardIds); | |
| 474 | 484 | } |
| 475 | 485 | |
| 476 | - $members = []; | |
| 477 | - | |
| 478 | - $memberUserIds = $memberUserIds->get() | |
| 486 | + $memberUserIds = $memberUserIdsQuery->get() | |
| 479 | 487 | ->pluck('foreign_id')->toArray(); |
| 480 | 488 | |
| 489 | + $members = []; | |
| 481 | 490 | |
| 482 | 491 | if ($memberUserIds) { |
| 483 | 492 | $memberUsers = get_users([ |
| 484 | 493 | 'include' => $memberUserIds |
