← All changes | app/Http/Controllers/CalendarController.php +105 -13 2.4.0 → 2.5.0 View file →

		@@ -118,8 +118,54 @@
118	118	'message' => __('The provided slug is available', 'fluent-booking')
119	119	];
120	120	}
121	121
	122	+ public function getNewEventLocationFields(Request $request)
	123	+ {
	124	+ $eventType = SanitizeService::checkCollection(
	125	+ sanitize_text_field($request->get('event_type', 'single')),
	126	+ CalendarSlot::getEventTypes(),
	127	+ 'single'
	128	+ );
	129	+
	130	+ // Resolve the organizer the same way createCalendar() does, so the
	131	+ // connection checks run against the host the event will be saved under.
	132	+ $canAssignOthers = PermissionManager::canManageOtherHosts();
	133	+
	134	+ $userId = get_current_user_id();
	135	+ $requestedUserId = (int) $request->get('user_id');
	136	+ if ($requestedUserId && $canAssignOthers) {
	137	+ $userId = $requestedUserId;
	138	+ }
	139	+
	140	+ $calendarEvent = new CalendarSlot();
	141	+ $calendarEvent->event_type = $eventType;
	142	+
	143	+ if ($calendarEvent->isMultiHostEvent()) {
	144	+ $teamMembers = array_values(array_unique(array_filter(
	145	+ array_map('intval', (array) $request->get('team_members', []))
	146	+ )));
	147	+
	148	+ if (!PermissionManager::canAssignHosts($teamMembers, [$userId])) {
	149	+ return $this->sendError([
	150	+ 'message' => __('You are not allowed to create a calendar for another user', 'fluent-booking')
	151	+ ], 403);
	152	+ }
	153	+
	154	+ if ($teamMembers && !in_array($userId, $teamMembers, true)) {
	155	+ $userId = reset($teamMembers);
	156	+ }
	157	+
	158	+ $calendarEvent->settings = ['team_members' => $teamMembers];
	159	+ }
	160	+
	161	+ $calendarEvent->user_id = $userId;
	162	+
	163	+ return [
	164	+ 'location_fields' => $calendarEvent->getLocationFields()
	165	+ ];
	166	+ }
	167	+
122	168	public function createCalendar(Request $request)
123	169	{
124	170	$data = $request->get('calendar');
125	171
		@@ -155,9 +201,9 @@
155	201	$this->validate($data, $validationConfig['rules'], $validationConfig['messages']);
156	202
157	203	do_action('fluent_booking/before_create_calendar', $data, $this);
158	204
159		- if (!empty($data['user_id']) && PermissionManager::userCan(['manage_all_data', 'invite_team_members'])) {
	205	+ if (!empty($data['user_id']) && PermissionManager::canManageOtherHosts()) {
160	206	$user = get_user_by('ID', $data['user_id']);
161	207	} else {
162	208	$user = get_user_by('ID', get_current_user_id());
163	209	}
		@@ -215,16 +261,16 @@
215	261	], 422);
216	262	}
217	263	}
218	264
	265	+ // Gated even when the creator is listed too, not only when they are absent.
	266	+ if (!PermissionManager::canAssignHosts($teamMembers, [$user->ID])) {
	267	+ return $this->sendError([
	268	+ 'message' => __('You are not allowed to create a calendar for another user', 'fluent-booking')
	269	+ ], 403);
	270	+ }
	271	+
219	272	if (!in_array($user->ID, $teamMembers, true)) {
220		- // Same privileged act as passing an explicit user_id above; gate it identically.
221		- if (!PermissionManager::userCan(['manage_all_data', 'invite_team_members'])) {
222		- return $this->sendError([
223		- 'message' => __('You are not allowed to create a calendar for another user', 'fluent-booking')
224		- ], 403);
225		- }
226		-
227	273	$user = get_user_by('ID', reset($teamMembers));
228	274	if (!$user) {
229	275	return $this->sendError([
230	276	'message' => __('Invalid Team Member', 'fluent-booking')
		@@ -359,10 +405,11 @@
359	405	{
360	406	$calendar = Calendar::findOrFail($calendarId);
361	407
362	408	return [
363		- 'settings' => LandingPageHelper::getSettings($calendar),
364		- 'share_url' => $calendar->getLandingPageUrl(true)
	409	+ 'settings' => LandingPageHelper::getSettings($calendar),
	410	+ 'share_url' => $calendar->getLandingPageUrl(true),
	411	+ 'public_url' => $this->getSharePublicUrl($calendar, intval($request->get('event_id')))
365	412	];
366	413	}
367	414
368	415	public function saveSharingSettings(Request $request, $calendarId)
		@@ -398,12 +445,27 @@
398	445	$sharingSettings = $request->get('landing_page_settings', []);
399	446	LandingPageHelper::updateSettings($calendar, $sharingSettings);
400	447
401	448	return [
402		- 'message' => __('Landing Page settings has been updated', 'fluent-booking')
	449	+ 'message' => __('Landing Page settings has been updated', 'fluent-booking'),
	450	+ 'public_url' => $this->getSharePublicUrl($calendar, intval($request->get('event_id')))
403	451	];
404	452	}
405	453
	454	+ private function getSharePublicUrl($calendar, $eventId)
	455	+ {
	456	+ if ($eventId) {
	457	+ $event = CalendarSlot::where('calendar_id', $calendar->id)
	458	+ ->where('id', $eventId)
	459	+ ->first();
	460	+ if ($event) {
	461	+ return $event->getPublicUrl();
	462	+ }
	463	+ }
	464	+
	465	+ return $calendar->getLandingPageUrl();
	466	+ }
	467	+
406	468	public function updateCalendar(Request $request, $calendarId)
407	469	{
408	470	$data = $request->all();
409	471
		@@ -532,8 +594,28 @@
532	594	], $slot);
533	595
534	596	$this->validate($slot, $validationConfig['rules'], $validationConfig['messages']);
535	597
	598	+ $teamMembers = array_values(array_unique(array_filter(
	599	+ array_map('intval', (array) Arr::get($slot, 'settings.team_members', []))
	600	+ )));
	601	+
	602	+ cache_users($teamMembers);
	603	+
	604	+ foreach ($teamMembers as $memberId) {
	605	+ if (!get_user_by('ID', $memberId)) {
	606	+ return $this->sendError([
	607	+ 'message' => __('Invalid Team Member', 'fluent-booking')
	608	+ ], 422);
	609	+ }
	610	+ }
	611	+
	612	+ if ($teamMembers && !PermissionManager::canAssignHosts($teamMembers, $calendar->getMemberIds())) {
	613	+ return $this->sendError([
	614	+ 'message' => __('You are not allowed to create a calendar for another user', 'fluent-booking')
	615	+ ], 403);
	616	+ }
	617	+
536	618	$availability = AvailabilityService::getDefaultSchedule($calendar->user_id);
537	619
538	620	$slotData = [
539	621	'title' => sanitize_text_field($slot['title']),
		@@ -552,13 +634,13 @@
552	634	'schedule_conditions' => SanitizeService::scheduleConditions(Arr::get($slot['settings'], 'schedule_conditions', [])),
553	635	'buffer_time_before' => sanitize_text_field(Arr::get($slot['settings'], 'buffer_time_before', '0')),
554	636	'buffer_time_after' => sanitize_text_field(Arr::get($slot['settings'], 'buffer_time_after', '0')),
555	637	'slot_interval' => sanitize_text_field(Arr::get($slot['settings'], 'slot_interval', '')),
556		- 'team_members' => array_map('intval', Arr::get($slot['settings'], 'team_members', []))
	638	+ 'team_members' => $teamMembers
557	639	],
558	640	'status' => SanitizeService::checkCollection($slot['status'], ['active', 'draft'], 'active'),
559	641	'color_schema' => sanitize_text_field(Arr::get($slot, 'color_schema', '#0099ff')),
560		- 'event_type' => sanitize_text_field(Arr::get($slot, 'event_type')),
	642	+ 'event_type' => SanitizeService::checkCollection(sanitize_text_field(Arr::get($slot, 'event_type')), CalendarSlot::getEventTypes(), 'single'),
561	643	'availability_type' => 'existing_schedule',
562	644	'availability_id' => $availability ? $availability->id : null,
563	645	'location_type' => sanitize_text_field(Arr::get($slot, 'location_type')),
564	646	'location_settings' => SanitizeService::locationSettings(Arr::get($slot, 'location_settings', [])),
		@@ -806,8 +888,18 @@
806	888
807	889	$calendar = Calendar::findOrFail($newCalendarId);
808	890
809	891	$originalEvent = CalendarSlot::with('event_metas')->where('calendar_id', $calendarId)->findOrFail($eventId);
	892	+
	893	+ $teamMembers = Arr::get($originalEvent->settings, 'team_members', []);
	894	+
	895	+ // Cloning into another calendar carries the source hosts along with it.
	896	+ if ($teamMembers && $calendar->id != $calendarId
	897	+ && !PermissionManager::canAssignHosts($teamMembers, $calendar->getMemberIds())) {
	898	+ return $this->sendError([
	899	+ 'message' => __('You are not allowed to create a calendar for another user', 'fluent-booking')
	900	+ ], 403);
	901	+ }
810	902
811	903	$clonedEvent = $originalEvent->replicate();
812	904
813	905	$clonedEvent->hash = null;