| @@ -196,9 +196,17 @@ | ||
| 196 | 196 | $bookingData['source_url'] = sanitize_url($sourceUrl); |
| 197 | 197 | } |
| 198 | 198 | |
| 199 | 199 | if ($hostUserId = Arr::get($postedData, 'host_user_id', null)) { |
| 200 | - $bookingData['host_user_id'] = (int) $hostUserId; | |
| 200 | + $hostUserId = (int) $hostUserId; | |
| 201 | + | |
| 202 | + if (!in_array($hostUserId, array_map('intval', $calendarEvent->getHostIds()), true)) { | |
| 203 | + return $this->sendError([ | |
| 204 | + 'message' => __('The selected host is not a host of this event', 'fluent-booking') | |
| 205 | + ], 422); | |
| 206 | + } | |
| 207 | + | |
| 208 | + $bookingData['host_user_id'] = $hostUserId; | |
| 201 | 209 | } |
| 202 | 210 | |
| 203 | 211 | $hostIds = null; |
| 204 | 212 | if ($calendarEvent->isRoundRobin() && !$hostUserId) { |
| @@ -305,9 +313,19 @@ | ||
| 305 | 313 | |
| 306 | 314 | $duration = $calendarEvent->getDuration($request->get('duration')); |
| 307 | 315 | |
| 308 | 316 | $hostId = $request->get('host_id', null); |
| 309 | - | |
| 317 | + | |
| 318 | + if ($hostId) { | |
| 319 | + $hostId = (int) $hostId; | |
| 320 | + | |
| 321 | + if (!in_array($hostId, array_map('intval', $calendarEvent->getHostIds()), true)) { | |
| 322 | + wp_send_json([ | |
| 323 | + 'message' => __('The selected host is not a host of this event', 'fluent-booking') | |
| 324 | + ], 422); | |
| 325 | + } | |
| 326 | + } | |
| 327 | + | |
| 310 | 328 | $timeSlotService = TimeSlotServiceHandler::initService($calendar, $calendarEvent); |
| 311 | 329 | |
| 312 | 330 | if (is_wp_error($timeSlotService)) { |
| 313 | 331 | return TimeSlotServiceHandler::sendError($timeSlotService, $calendarEvent, $timeZone); |
