← All changes | app/Http/Policies/CalendarPolicy.php +19 -17 2.2.5 → 2.5.0 View file →

		@@ -35,16 +35,17 @@
35	35	}
36	36
37	37	$method = $request->getMethod();
38	38
	39	+ // Event-scoped for reads too: hosting one event must not expose its sibling events' settings.
	40	+ if ($eventId) {
	41	+ return PermissionManager::canUpdateCalendarEvent($eventId);
	42	+ }
	43	+
39	44	if ($method == 'GET') {
40	45	return PermissionManager::canReadCalendar($calendarId);
41	46	}
42	47
43		- if ($eventId) {
44		- return PermissionManager::canUpdateCalendarEvent($eventId);
45		- }
46		-
47	48	return PermissionManager::canWriteCalendar($calendarId);
48	49	}
49	50
50	51	public function getAllCalendars(Request $request)
		@@ -53,22 +54,19 @@
53	54	}
54	55
55	56	public function createCalendar(Request $request)
56	57	{
57		- if (PermissionManager::userCan(['manage_all_data', 'invite_team_members'])) {
58		- return true;
59		- }
	58	+ return $this->canCreateCalendar();
	59	+ }
60	60
61		- if (PermissionManager::userCan('manage_own_calendar')) {
62		- return true;
63		- }
64		-
65		- return false;
	61	+ public function checkSlug(Request $request)
	62	+ {
	63	+ return $this->canCreateCalendar();
66	64	}
67	65
68		- public function checkSlug(Request $request)
	66	+ public function getNewEventLocationFields(Request $request)
69	67	{
70		- return PermissionManager::userCan(['manage_all_data', 'invite_team_members', 'manage_own_calendar']);
	68	+ return $this->canCreateCalendar();
71	69	}
72	70
73	71	public function getEvent(Request $request, $calendarId, $eventId)
74	72	{
		@@ -114,12 +112,16 @@
114	112
115	113	return PermissionManager::canWriteCalendar($destinationCalendarId);
116	114	}
117	115
	116	+ private function canCreateCalendar()
	117	+ {
	118	+ return PermissionManager::userCan(['manage_all_data', 'invite_team_members', 'manage_own_calendar']);
	119	+ }
	120	+
118	121	/**
119		- * Read a URL-only route parameter safely. Some routes under this prefix
120		- * (event-lists, root listing, create) have no path placeholder, so a
121		- * direct array access would emit an undefined-array-key warning.
	122	+ * Read a URL route parameter. Some routes here (event-lists, root listing,
	123	+ * create) have no placeholder, so direct access would warn.
122	124	*/
123	125	private function getRouteParam(Request $request, $key)
124	126	{
125	127	$params = (array) $request->get_url_params();