fluent-booking / app / Http / Policies / MeetingPolicy.php

MeetingPolicy.php in Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution 2.1.2, at app/Http/Policies/MeetingPolicy.php

141 lines 3.8 KB

Raw Download Zip

1	<?php
2
3	namespace FluentBooking\App\Http\Policies;
4
5	use FluentBooking\App\Models\Booking;
6	use FluentBooking\App\Models\CalendarSlot;
7	use FluentBooking\App\Services\PermissionManager;
8	use FluentBooking\Framework\Http\Request\Request;
9	use FluentBooking\Framework\Foundation\Policy;
10
11	class MeetingPolicy extends Policy
12	{
13	/**
14	* Check user permission for any method
15	* @param \FluentBooking\Framework\Http\Request\Request $request
16	* @return Boolean
17	*/
18	public function verifyRequest(Request $request)
19	{
20	if (PermissionManager::userCan(['manage_all_bookings', 'manage_all_data'])) {
21	return true;
22	}
23
24	// Authorize only against the URL route parameter so request-body
25	// values cannot override the resource being acted on.
26	$bookingId = $this->getRouteBookingId($request);
27
28	if ($request->method() == 'GET') {
29	if (PermissionManager::userCan(['manage_own_calendar','read_all_bookings'])) {
30	return true;
31	}
32
33	if ($bookingId) {
34	$booking = Booking::find($bookingId);
35	return $this->hasBookingAccess($booking);
36	}
37	}
38
39	if ($bookingId) {
40	$booking = Booking::find($bookingId);
41	return $this->hasBookingAccess($booking);
42	}
43
44	return false;
45	}
46
47	public function getGroupAttendees(Request $request)
48	{
49	if (current_user_can('manage_options')) {
50	return true;
51	}
52
53	if (PermissionManager::userCanSeeAllBookings()) {
54	return true;
55	}
56
57	$groupId = $this->getRouteParam($request, 'group_id');
58
59	if (!$groupId) {
60	return false;
61	}
62
63	$booking = Booking::where('group_id', $groupId)->first();
64
65	return $this->hasBookingAccess($booking);
66	}
67
68	public function getBookingActivities(Request $request)
69	{
70	return $this->authorizeBookingAccess($request);
71	}
72
73	public function getBookingMetaInfo(Request $request)
74	{
75	return $this->authorizeBookingAccess($request);
76	}
77
78	private function authorizeBookingAccess(Request $request)
79	{
80	if (PermissionManager::userCan(['manage_all_bookings', 'manage_all_data', 'read_all_bookings'])) {
81	return true;
82	}
83
84	$bookingId = $this->getRouteBookingId($request);
85
86	if (!$bookingId) {
87	return false;
88	}
89
90	$booking = Booking::find($bookingId);
91
92	return $this->hasBookingAccess($booking);
93	}
94
95	/**
96	* Resolve the booking ID from the URL route parameter only.
97	*
98	* Why: merged request inputs let JSON body values shadow URL params,
99	* which previously allowed authorizing against an attacker-owned ID
100	* while the controller acted on the URL-targeted victim ID.
101	*/
102	private function getRouteBookingId(Request $request)
103	{
104	return $this->getRouteParam($request, 'id');
105	}
106
107	/**
108	* Read a URL-only route parameter safely. Routes such as /schedules/
109	* and /schedules/export have no path placeholders, so a direct
110	* access would emit an undefined-array-key warning under PHP 8.
111	*/
112	private function getRouteParam(Request $request, $key)
113	{
114	$params = (array) $request->get_url_params();
115	return isset($params[$key]) ? $params[$key] : null;
116	}
117
118	private function hasBookingAccess($booking)
119	{
120	if (!$booking) {
121	return false;
122	}
123
124	$userId = get_current_user_id();
125	if (in_array($userId, $booking->getHostIds())) {
126	return true;
127	}
128
129	if (!PermissionManager::userCan('manage_own_calendar')) {
130	return false;
131	}
132
133	$calendarEvent = CalendarSlot::find($booking->event_id);
134	if (!$calendarEvent) {
135	return false;
136	}
137
138	return in_array($userId, $calendarEvent->getHostIds());
139	}
140	}
141