| @@ -313,9 +313,19 @@ | ||
| 313 | 313 | |
| 314 | 314 | $duration = $calendarEvent->getDuration($request->get('duration')); |
| 315 | 315 | |
| 316 | 316 | $hostId = $request->get('host_id', null); |
| 317 | - | |
| 317 | + | |
| 318 | + if ($hostId) { | |
| 319 | + $hostId = (int) $hostId; | |
| 320 | + | |
| 321 | + if (!in_array($hostId, array_map('intval', $calendarEvent->getHostIds()), true)) { | |
| 322 | + wp_send_json([ | |
| 323 | + 'message' => __('The selected host is not a host of this event', 'fluent-booking') | |
| 324 | + ], 422); | |
| 325 | + } | |
| 326 | + } | |
| 327 | + | |
| 318 | 328 | $timeSlotService = TimeSlotServiceHandler::initService($calendar, $calendarEvent); |
| 319 | 329 | |
| 320 | 330 | if (is_wp_error($timeSlotService)) { |
| 321 | 331 | return TimeSlotServiceHandler::sendError($timeSlotService, $calendarEvent, $timeZone); |
