← All changes | app/Http/Controllers/MailBoxController.php +83 -28 1.10.4 → 2.4.5 View file →

		@@ -2,17 +2,18 @@
2	2
3	3	namespace FluentSupport\App\Http\Controllers;
4	4
5	5	use FluentSupport\App\Models\MailBox;
	6	+use FluentSupport\App\Modules\PermissionManager;
6	7	use FluentSupport\App\Services\EmailNotification\Settings;
	8	+use FluentSupport\App\Services\Helper;
7	9	use FluentSupport\App\Services\MailerInbox\MailBoxService;
8		-use FluentSupport\Framework\Request\Request;
	10	+use FluentSupport\Framework\Http\Request\Request;
9	11
10	12	class MailBoxController extends Controller
11	13	{
12	14	/**
13		- * index method will return the list of business inbox
14		- * @param Request $request
	15	+ * @param MailBoxService $mailboxService
15	16	* @return array
16	17	*/
17	18	public function index(MailBoxService $mailboxService)
18	19	{
		@@ -19,11 +20,10 @@
19	20	return $mailboxService->getMailBoxes();
20	21	}
21	22
22	23	/**
23		- * get method will fetch and return information related to business box
24		- * @param Request $request
25		- * @param $id
	24	+ * @param MailBox $mailBox
	25	+ * @param int $id
26	26	* @return mixed
27	27	*/
28	28	public function get( MailBox $mailBox, $id )
29	29	{
		@@ -34,9 +34,8 @@
34	34	}
35	35
36	36
37	37	/**
38		- * Save method will create new business box
39	38	* @param Request $request
40	39	* @param MailBox $mailBox
41	40	* @return array
42	41	* @throws \FluentSupport\Framework\Validator\ValidationException
		@@ -42,9 +41,10 @@
42	41	* @throws \FluentSupport\Framework\Validator\ValidationException
43	42	*/
44	43	public function save(Request $request, MailBox $mailBox)
45	44	{
46		- $data = wp_unslash( $request->getSafe('business') );
	45	+ $data = wp_unslash( $request->get('business', null) );
	46	+ $data = $this->sanitizeMailboxData($data);
47	47
48	48	$this->validate($data, [
49	49	'name' => 'required',
50	50	'email' => 'required'
		@@ -56,9 +56,8 @@
56	56	];
57	57	}
58	58
59	59	/**
60		- * This `update` method will update existing information for a business by mailbox id
61	60	* @param Request $request
62	61	* @param MailBox $mailBox
63	62	* @param int $id
64	63	* @return array
		@@ -66,9 +65,10 @@
66	65	*/
67	66	public function update(Request $request, MailBox $mailBox, $id)
68	67	{
69	68	try{
70		- $data = wp_unslash( $request->getSafe('business') );
	69	+ $data = wp_unslash( $request->get('business', null) );
	70	+ $data = $this->sanitizeMailboxData($data);
71	71
72	72	$this->validate($data, [
73	73	'name' => 'required',
74	74	'email' => 'required'
		@@ -79,15 +79,16 @@
79	79	'mailbox' => $mailBox->updateMailBox( $data, $id )
80	80	];
81	81	}catch (\Exception $e){
82	82	return [
83		- 'message' => $e->getMessage(),
	83	+ 'message' => Helper::getSafeErrorMessage($e),
84	84	];
85	85	}
86	86	}
87	87
88	88	/**
89		- * This `delete` method will delete a business from mailbox and replaced with alternative
	89	+ * Tickets move to the mailbox given by fallback_id.
	90	+ *
90	91	* @param Request $request
91	92	* @param MailBoxService $mailBoxService
92	93	* @param int $id
93	94	* @throws \Exception
		@@ -98,9 +99,9 @@
98	99	try {
99	100	return $mailBoxService->deleteMailBox( $id, $request->getSafe('fallback_id', 'intval') );
100	101	} catch (\Exception $e) {
101	102	return [
102		- 'message' => $e->getMessage(),
	103	+ 'message' => Helper::getSafeErrorMessage($e),
103	104	];
104	105	}
105	106	}
106	107
		@@ -105,9 +106,8 @@
105	106	}
106	107
107	108
108	109	/**
109		- * This `moveTickets` method will move tickets from one mailbox to another
110	110	* @param Request $request
111	111	* @param MailBoxService $mailBoxService
112	112	* @param int $id
113	113	* @throws \Exception
		@@ -116,19 +116,28 @@
116	116	public function moveTickets(Request $request, MailBoxService $mailBoxService, $id)
117	117	{
118	118	try {
119	119	$data = $request->only(['ticket_ids', 'new_box_id', 'move_type']);
	120	+
	121	+ // Current-user mailbox access. Checked here rather than inside
	122	+ // MailBoxService::moveTickets(), which is also called by Pro
	123	+ // workflows and MCP on behalf of an automation/agent-tool call
	124	+ // that isn't the logged-in browser session.
	125	+ $restrictedForCurrentUser = array_map('intval', PermissionManager::getRestrictedMailboxIds());
	126	+ if (in_array((int) $data['new_box_id'], $restrictedForCurrentUser, true)) {
	127	+ return $this->sendError(__('You do not have access to the specified mailbox', 'fluent-support'));
	128	+ }
	129	+
120	130	return $mailBoxService->moveTickets( $data, $id );
121	131	} catch (\Exception $e) {
122		- return $this->sendError($e->getMessage());
	132	+ return $this->sendError(Helper::getSafeErrorMessage($e));
123	133	}
124	134	}
125	135
126	136	/**
127		- * This `getEmailSettings` method will get and return the mailbox email settings
128	137	* @param Request $request
129	138	* @param Settings $settings
130		- * @param $id
	139	+ * @param int $id
131	140	* @return array
132	141	*/
133	142	public function getEmailSettings(Request $request, Settings $settings, $id)
134	143	{
		@@ -140,11 +149,10 @@
140	149	];
141	150	}
142	151
143	152	/**
144		- * This `getEmailsSetups` method will return email settings for a business box by box id
145	153	* @param MailBoxService $mailBoxService
146		- * @param $id
	154	+ * @param int $id
147	155	* @return array
148	156	*/
149	157	public function getEmailsSetups( MailBoxService $mailBoxService, $id )
150	158	{
		@@ -151,18 +159,27 @@
151	159	return $mailBoxService->getEmailsSetups($id);
152	160	}
153	161
154	162	/**
155		- * This `saveEmailSettings` method will save the email settings for a business box using box id
156	163	* @param Request $request
157		- * @param Settings $settings
158		- * @param $id
	164	+ * @param MailBoxService $mailBoxService
	165	+ * @param int $id
159	166	* @return array
160	167	* @throws \FluentSupport\Framework\Validator\ValidationException
161	168	*/
162	169	public function saveEmailSettings( Request $request, MailBoxService $mailBoxService, $id )
163	170	{
164		- $data = wp_unslash($request->getSafe('email_settings'));
	171	+ $data = wp_unslash($request->get('email_settings', null));
	172	+ $data = is_array($data) ? [
	173	+ 'key' => isset($data['key']) ? sanitize_key($data['key']) : '',
	174	+ 'title' => isset($data['title']) ? sanitize_text_field($data['title']) : '',
	175	+ 'email_subject' => isset($data['email_subject']) ? sanitize_text_field($data['email_subject']) : '',
	176	+ 'email_body' => isset($data['email_body']) ? wp_kses_post($data['email_body']) : '',
	177	+ 'status' => isset($data['status']) ? sanitize_text_field($data['status']) : '',
	178	+ 'can_edit_subject' => isset($data['can_edit_subject']) ? sanitize_text_field($data['can_edit_subject']) : '',
	179	+ 'send_attachments' => isset($data['send_attachments']) ? sanitize_text_field($data['send_attachments']) : '',
	180	+ ] : [];
	181	+
165	182	$emailType = $request->getSafe('email_type', 'sanitize_text_field');
166	183
167	184	$this->validate($data, [
168	185	'email_subject' => 'required',
		@@ -172,11 +189,10 @@
172	189	return $mailBoxService->saveEmailSettings( $emailType, $id, $data );
173	190	}
174	191
175	192	/**
176		- * This `setAsDefault` method will set a business box as default
177	193	* @param MailBoxService $mailBoxService
178		- * @param $id
	194	+ * @param int $id
179	195	* @return array
180	196	*/
181	197	public function setAsDefault( MailBoxService $mailBoxService, $id )
182	198	{
		@@ -183,15 +199,54 @@
183	199	return $mailBoxService->setAsDefault( $id );
184	200	}
185	201
186	202	/**
187		- * This `getTickets` method will return the list of tickets for a business box
188	203	* @param Request $request
189		- * @param MailBox $mailBox
	204	+ * @param MailBoxService $mailBoxService
190	205	* @param int $id
191	206	* @return array
192	207	*/
193	208	public function getTickets(Request $request, MailBoxService $mailBoxService, $id)
194	209	{
195		- return $mailBoxService->getTickets( $request->getSafe('filters'), $id );
	210	+ $filters = $request->get('filters', null);
	211	+ $filters = is_array($filters) ? [
	212	+ 'status_type' => isset($filters['status_type']) ? sanitize_text_field($filters['status_type']) : '',
	213	+ 'customer_id' => isset($filters['customer_id']) ? intval($filters['customer_id']) : 0,
	214	+ 'product_id' => isset($filters['product_id']) ? intval($filters['product_id']) : 0,
	215	+ 'mailbox_id' => isset($filters['mailbox_id']) ? intval($filters['mailbox_id']) : 0,
	216	+ 'ticket_title' => isset($filters['ticket_title']) ? sanitize_text_field($filters['ticket_title']) : '',
	217	+ 'notes' => isset($filters['notes']) ? sanitize_text_field($filters['notes']) : '',
	218	+ ] : [];
	219	+
	220	+ return $mailBoxService->getTickets( $filters, $id );
	221	+ }
	222	+
	223	+ /**
	224	+ * @param mixed $data
	225	+ * @return array
	226	+ */
	227	+ private function sanitizeMailboxData($data)
	228	+ {
	229	+ if (!is_array($data)) {
	230	+ return [];
	231	+ }
	232	+
	233	+ $sanitized = [
	234	+ 'name' => isset($data['name']) ? sanitize_text_field($data['name']) : '',
	235	+ 'email' => isset($data['email']) ? sanitize_email($data['email']) : '',
	236	+ 'box_type' => isset($data['box_type']) ? sanitize_key($data['box_type']) : '',
	237	+ 'mapped_email' => isset($data['mapped_email']) ? sanitize_email($data['mapped_email']) : '',
	238	+ 'email_footer' => isset($data['email_footer']) ? wp_kses_post($data['email_footer']) : '',
	239	+ 'is_default' => isset($data['is_default']) ? sanitize_text_field($data['is_default']) : 'no',
	240	+ ];
	241	+
	242	+ if (isset($data['settings']) && is_array($data['settings'])) {
	243	+ $sanitized['settings'] = map_deep($data['settings'], 'sanitize_text_field');
	244	+ // Re-sanitize as an email, not plain text.
	245	+ if (isset($data['settings']['admin_email_address'])) {
	246	+ $sanitized['settings']['admin_email_address'] = sanitize_email($data['settings']['admin_email_address']);
	247	+ }
	248	+ }
	249	+
	250	+ return $sanitized;
196	251	}
197	252	}