← All changes | app/Http/Policies/MeetingPolicy.php +115 -24 1.5.21 → 2.5.0 View file →

		@@ -1,8 +1,10 @@
1	1	<?php
2	2
3	3	namespace FluentBooking\App\Http\Policies;
4	4
	5	+use FluentBooking\App\Models\Booking;
	6	+use FluentBooking\App\Models\CalendarSlot;
5	7	use FluentBooking\App\Services\PermissionManager;
6	8	use FluentBooking\Framework\Http\Request\Request;
7	9	use FluentBooking\Framework\Foundation\Policy;
8	10
		@@ -14,60 +16,149 @@
14	16	* @return Boolean
15	17	*/
16	18	public function verifyRequest(Request $request)
17	19	{
18		- if (current_user_can('manage_options')) {
	20	+ if (PermissionManager::userCan(['manage_all_bookings', 'manage_all_data'])) {
19	21	return true;
20	22	}
21	23
22		- if ($request->method() == 'GET') {
23		- if (PermissionManager::userCan(['manage_own_calendar','read_all_bookings', 'manage_all_bookings'])) {
	24	+ // Authorize only against the URL route parameter so request-body
	25	+ // values cannot override the resource being acted on.
	26	+ $bookingId = $this->getRouteBookingId($request);
	27	+
	28	+ if ($request->getMethod() == 'GET') {
	29	+ if (PermissionManager::userCan(['manage_own_calendar','read_all_bookings'])) {
24	30	return true;
25	31	}
26		- if ($request->id) {
27		- $booking = \FluentBooking\App\Models\Booking::find($request->id);
28		- if (!$booking) {
29		- return false;
30		- }
31	32
32		- return in_array(get_current_user_id(), $booking->getHostIds());
	33	+ if ($bookingId) {
	34	+ $booking = Booking::find($bookingId);
	35	+ return $this->hasBookingAccess($booking);
33	36	}
	37	+ }
34	38
35		- return PermissionManager::userCan('manage_own_calendar');
	39	+ if ($bookingId) {
	40	+ $booking = Booking::find($bookingId);
	41	+ return $this->hasBookingAccess($booking);
36	42	}
37	43
38		- if (PermissionManager::userCan(['manage_own_calendar', 'manage_all_bookings'])) {
	44	+ return false;
	45	+ }
	46	+
	47	+ public function getGroupAttendees(Request $request)
	48	+ {
	49	+ if (current_user_can('manage_options')) {
39	50	return true;
40	51	}
41	52
42		- if ($request->id) {
43		- $booking = \FluentBooking\App\Models\Booking::find($request->id);
44		- if (!$booking) {
45		- return false;
46		- }
	53	+ if (PermissionManager::userCanSeeAllBookings()) {
	54	+ return true;
	55	+ }
47	56
48		- return in_array(get_current_user_id(), $booking->getHostIds());
	57	+ $groupId = $this->getRouteParam($request, 'group_id');
	58	+
	59	+ if (!$groupId) {
	60	+ return false;
49	61	}
50	62
51		- return PermissionManager::userCan('manage_own_calendar');
	63	+ $booking = Booking::where('group_id', $groupId)->first();
	64	+
	65	+ return $this->hasBookingAccess($booking);
52	66	}
53	67
54		- public function getGroupAttendees(Request $request)
	68	+ public function getBookingActivities(Request $request)
55	69	{
56		- if (current_user_can('manage_options')) {
	70	+ return $this->authorizeBookingAccess($request);
	71	+ }
	72	+
	73	+ public function getNotes(Request $request)
	74	+ {
	75	+ return $this->authorizeBookingAccess($request);
	76	+ }
	77	+
	78	+ public function getBookingMetaInfo(Request $request)
	79	+ {
	80	+ return $this->authorizeBookingAccess($request);
	81	+ }
	82	+
	83	+ public function getCrmContact(Request $request)
	84	+ {
	85	+ return $this->authorizeBookingAccess($request);
	86	+ }
	87	+
	88	+ public function getCrmOptions(Request $request)
	89	+ {
	90	+ return $this->authorizeBookingAccess($request);
	91	+ }
	92	+
	93	+ // State-changing: use verifyRequest so read-only roles (read_all_bookings)
	94	+ // cannot mutate CRM data; only host access or manage_all_* passes for POST.
	95	+ public function updateCrmTags(Request $request)
	96	+ {
	97	+ return $this->verifyRequest($request);
	98	+ }
	99	+
	100	+ public function updateCrmLists(Request $request)
	101	+ {
	102	+ return $this->verifyRequest($request);
	103	+ }
	104	+
	105	+ private function authorizeBookingAccess(Request $request)
	106	+ {
	107	+ if (PermissionManager::userCan(['manage_all_bookings', 'manage_all_data', 'read_all_bookings'])) {
57	108	return true;
58	109	}
59	110
60		- if (PermissionManager::userCan(['read_all_bookings', 'manage_all_bookings'])) {
61		- return true;
	111	+ $bookingId = $this->getRouteBookingId($request);
	112	+
	113	+ if (!$bookingId) {
	114	+ return false;
62	115	}
63	116
64		- $booking = \FluentBooking\App\Models\Booking::where('group_id', $request->group_id)->first();
	117	+ $booking = Booking::find($bookingId);
65	118
	119	+ return $this->hasBookingAccess($booking);
	120	+ }
	121	+
	122	+ /**
	123	+ * Resolve the booking ID from the URL route parameter only. Merged inputs
	124	+ * let a body value shadow the URL, so a check could pass on one ID while
	125	+ * the controller acts on another.
	126	+ */
	127	+ private function getRouteBookingId(Request $request)
	128	+ {
	129	+ return $this->getRouteParam($request, 'id');
	130	+ }
	131	+
	132	+ /**
	133	+ * Read a URL route parameter. Some routes (/schedules/, /schedules/export)
	134	+ * have no placeholder, so direct access would warn under PHP 8.
	135	+ */
	136	+ private function getRouteParam(Request $request, $key)
	137	+ {
	138	+ $params = (array) $request->get_url_params();
	139	+ return isset($params[$key]) ? $params[$key] : null;
	140	+ }
	141	+
	142	+ private function hasBookingAccess($booking)
	143	+ {
66	144	if (!$booking) {
67	145	return false;
68	146	}
69	147
70		- return in_array(get_current_user_id(), $booking->getHostIds());
	148	+ $userId = get_current_user_id();
	149	+ if (in_array($userId, $booking->getHostIds())) {
	150	+ return true;
	151	+ }
71	152
	153	+ if (!PermissionManager::userCan('manage_own_calendar')) {
	154	+ return false;
	155	+ }
	156	+
	157	+ $calendarEvent = CalendarSlot::find($booking->event_id);
	158	+ if (!$calendarEvent) {
	159	+ return false;
	160	+ }
	161	+
	162	+ return in_array($userId, $calendarEvent->getHostIds());
72	163	}
73	164	}