← All changes | app/Http/Policies/CalendarPolicy.php +62 -26 1.7.0 → 2.5.0 View file →

		@@ -2,8 +2,9 @@
2	2
3	3	namespace FluentBooking\App\Http\Policies;
4	4
5	5	use FluentBooking\App\Models\Calendar;
	6	+use FluentBooking\App\Models\CalendarSlot;
6	7	use FluentBooking\App\Services\PermissionManager;
7	8	use FluentBooking\Framework\Http\Request\Request;
8	9	use FluentBooking\Framework\Foundation\Policy;
9	10
		@@ -15,59 +16,57 @@
15	16	* @return bool
16	17	*/
17	18	public function verifyRequest(Request $request)
18	19	{
19		- if (current_user_can('manage_options')) {
	20	+ if (PermissionManager::userCan('manage_all_data')) {
20	21	return true;
21	22	}
22	23
23		- $calendarId = $request->calendar_id;
	24	+ // Resolve IDs strictly from URL route params; request-body values
	25	+ // must never be allowed to redirect the authorization target.
	26	+ $calendarId = (int) $this->getRouteParam($request, 'id');
	27	+ $eventId = (int) $this->getRouteParam($request, 'event_id');
24	28
25	29	if (!$calendarId) {
26	30	return apply_filters('fluent_booking/verify_calendar_api', current_user_can('manage_options'), $request);
27	31	}
28	32
29		- $method = $request->method();
30		-
31		- if ($method == 'GET') {
32		- return PermissionManager::canReadCalendar($calendarId);
	33	+ if ($eventId && !CalendarSlot::where('calendar_id', $calendarId)->where('id', $eventId)->exists()) {
	34	+ return false;
33	35	}
34	36
35		- $eventId = $request->event_id;
	37	+ $method = $request->getMethod();
36	38
	39	+ // Event-scoped for reads too: hosting one event must not expose its sibling events' settings.
37	40	if ($eventId) {
38	41	return PermissionManager::canUpdateCalendarEvent($eventId);
39	42	}
40	43
	44	+ if ($method == 'GET') {
	45	+ return PermissionManager::canReadCalendar($calendarId);
	46	+ }
	47	+
41	48	return PermissionManager::canWriteCalendar($calendarId);
42	49	}
43	50
44	51	public function getAllCalendars(Request $request)
45	52	{
46		- return !!PermissionManager::currentUserHasAnyPemrmission();
	53	+ return !!PermissionManager::currentUserHasAnyPermission();
47	54	}
48	55
49	56	public function createCalendar(Request $request)
50	57	{
51		- if (PermissionManager::userCan('invite_team_members')) {
52		- return true;
53		- }
	58	+ return $this->canCreateCalendar();
	59	+ }
54	60
55		- if (PermissionManager::userCan('manage_own_calendar')) {
56		-
57		- $exist = Calendar::where('user_id', get_current_user_id())->first();
58		- if (!$exist) {
59		- return true;
60		- }
61		-
62		- return true;
63		- }
64		-
	61	+ public function checkSlug(Request $request)
	62	+ {
	63	+ return $this->canCreateCalendar();
65	64	}
66	65
67		- public function checkSlug(Request $request)
	66	+ public function getNewEventLocationFields(Request $request)
68	67	{
69		- return PermissionManager::userCan(['invite_team_members', 'manage_own_calendar']);
	68	+ return $this->canCreateCalendar();
70	69	}
71	70
72	71	public function getEvent(Request $request, $calendarId, $eventId)
73	72	{
		@@ -75,20 +74,57 @@
75	74	}
76	75
77	76	public function deleteCalendar(Request $request)
78	77	{
79		- if (current_user_can('manage_options')) {
	78	+ if (PermissionManager::userCan('manage_all_data')) {
80	79	return true;
81	80	}
82	81
83		- $calendarId = $request->id;
	82	+ $calendarId = (int) $this->getRouteParam($request, 'id');
84	83
85	84	$calendar = Calendar::find($calendarId);
86	85
87		- return $calendar->user_id === get_current_user_id();
	86	+ if (!$calendar) {
	87	+ return false;
	88	+ }
	89	+
	90	+ return $calendar->user_id == get_current_user_id();
88	91	}
89	92
90	93	public function deleteCalendarEvent(Request $request)
91	94	{
92	95	return $this->deleteCalendar($request);
	96	+ }
	97	+
	98	+ public function cloneCalendarEvent(Request $request)
	99	+ {
	100	+ if (PermissionManager::userCan('manage_all_data')) {
	101	+ return true;
	102	+ }
	103	+
	104	+ $eventId = (int) $this->getRouteParam($request, 'event_id');
	105	+
	106	+ if (!$eventId || !PermissionManager::canUpdateCalendarEvent($eventId)) {
	107	+ return false;
	108	+ }
	109	+
	110	+ $sourceCalendarId = (int) $this->getRouteParam($request, 'id');
	111	+ $destinationCalendarId = intval($request->get('new_calendar_id')) ?: $sourceCalendarId;
	112	+
	113	+ return PermissionManager::canWriteCalendar($destinationCalendarId);
	114	+ }
	115	+
	116	+ private function canCreateCalendar()
	117	+ {
	118	+ return PermissionManager::userCan(['manage_all_data', 'invite_team_members', 'manage_own_calendar']);
	119	+ }
	120	+
	121	+ /**
	122	+ * Read a URL route parameter. Some routes here (event-lists, root listing,
	123	+ * create) have no placeholder, so direct access would warn.
	124	+ */
	125	+ private function getRouteParam(Request $request, $key)
	126	+ {
	127	+ $params = (array) $request->get_url_params();
	128	+ return isset($params[$key]) ? $params[$key] : null;
93	129	}
94	130	}