← All changes | app/Http/Controllers/MailBoxController.php +23 -24 2.3.2 → 2.4.5 View file →

		@@ -2,8 +2,9 @@
2	2
3	3	namespace FluentSupport\App\Http\Controllers;
4	4
5	5	use FluentSupport\App\Models\MailBox;
	6	+use FluentSupport\App\Modules\PermissionManager;
6	7	use FluentSupport\App\Services\EmailNotification\Settings;
7	8	use FluentSupport\App\Services\Helper;
8	9	use FluentSupport\App\Services\MailerInbox\MailBoxService;
9	10	use FluentSupport\Framework\Http\Request\Request;
		@@ -10,10 +11,9 @@
10	11
11	12	class MailBoxController extends Controller
12	13	{
13	14	/**
14		- * index method will return the list of business inbox
15		- * @param Request $request
	15	+ * @param MailBoxService $mailboxService
16	16	* @return array
17	17	*/
18	18	public function index(MailBoxService $mailboxService)
19	19	{
		@@ -20,11 +20,10 @@
20	20	return $mailboxService->getMailBoxes();
21	21	}
22	22
23	23	/**
24		- * get method will fetch and return information related to business box
25		- * @param Request $request
26		- * @param $id
	24	+ * @param MailBox $mailBox
	25	+ * @param int $id
27	26	* @return mixed
28	27	*/
29	28	public function get( MailBox $mailBox, $id )
30	29	{
		@@ -35,9 +34,8 @@
35	34	}
36	35
37	36
38	37	/**
39		- * Save method will create new business box
40	38	* @param Request $request
41	39	* @param MailBox $mailBox
42	40	* @return array
43	41	* @throws \FluentSupport\Framework\Validator\ValidationException
		@@ -58,9 +56,8 @@
58	56	];
59	57	}
60	58
61	59	/**
62		- * This `update` method will update existing information for a business by mailbox id
63	60	* @param Request $request
64	61	* @param MailBox $mailBox
65	62	* @param int $id
66	63	* @return array
		@@ -88,9 +85,10 @@
88	85	}
89	86	}
90	87
91	88	/**
92		- * This `delete` method will delete a business from mailbox and replaced with alternative
	89	+ * Tickets move to the mailbox given by fallback_id.
	90	+ *
93	91	* @param Request $request
94	92	* @param MailBoxService $mailBoxService
95	93	* @param int $id
96	94	* @throws \Exception
		@@ -108,9 +106,8 @@
108	106	}
109	107
110	108
111	109	/**
112		- * This `moveTickets` method will move tickets from one mailbox to another
113	110	* @param Request $request
114	111	* @param MailBoxService $mailBoxService
115	112	* @param int $id
116	113	* @throws \Exception
		@@ -119,8 +116,18 @@
119	116	public function moveTickets(Request $request, MailBoxService $mailBoxService, $id)
120	117	{
121	118	try {
122	119	$data = $request->only(['ticket_ids', 'new_box_id', 'move_type']);
	120	+
	121	+ // Current-user mailbox access. Checked here rather than inside
	122	+ // MailBoxService::moveTickets(), which is also called by Pro
	123	+ // workflows and MCP on behalf of an automation/agent-tool call
	124	+ // that isn't the logged-in browser session.
	125	+ $restrictedForCurrentUser = array_map('intval', PermissionManager::getRestrictedMailboxIds());
	126	+ if (in_array((int) $data['new_box_id'], $restrictedForCurrentUser, true)) {
	127	+ return $this->sendError(__('You do not have access to the specified mailbox', 'fluent-support'));
	128	+ }
	129	+
123	130	return $mailBoxService->moveTickets( $data, $id );
124	131	} catch (\Exception $e) {
125	132	return $this->sendError(Helper::getSafeErrorMessage($e));
126	133	}
		@@ -126,12 +133,11 @@
126	133	}
127	134	}
128	135
129	136	/**
130		- * This `getEmailSettings` method will get and return the mailbox email settings
131	137	* @param Request $request
132	138	* @param Settings $settings
133		- * @param $id
	139	+ * @param int $id
134	140	* @return array
135	141	*/
136	142	public function getEmailSettings(Request $request, Settings $settings, $id)
137	143	{
		@@ -143,11 +149,10 @@
143	149	];
144	150	}
145	151
146	152	/**
147		- * This `getEmailsSetups` method will return email settings for a business box by box id
148	153	* @param MailBoxService $mailBoxService
149		- * @param $id
	154	+ * @param int $id
150	155	* @return array
151	156	*/
152	157	public function getEmailsSetups( MailBoxService $mailBoxService, $id )
153	158	{
		@@ -154,12 +159,11 @@
154	159	return $mailBoxService->getEmailsSetups($id);
155	160	}
156	161
157	162	/**
158		- * This `saveEmailSettings` method will save the email settings for a business box using box id
159	163	* @param Request $request
160		- * @param Settings $settings
161		- * @param $id
	164	+ * @param MailBoxService $mailBoxService
	165	+ * @param int $id
162	166	* @return array
163	167	* @throws \FluentSupport\Framework\Validator\ValidationException
164	168	*/
165	169	public function saveEmailSettings( Request $request, MailBoxService $mailBoxService, $id )
		@@ -185,11 +189,10 @@
185	189	return $mailBoxService->saveEmailSettings( $emailType, $id, $data );
186	190	}
187	191
188	192	/**
189		- * This `setAsDefault` method will set a business box as default
190	193	* @param MailBoxService $mailBoxService
191		- * @param $id
	194	+ * @param int $id
192	195	* @return array
193	196	*/
194	197	public function setAsDefault( MailBoxService $mailBoxService, $id )
195	198	{
		@@ -196,11 +199,10 @@
196	199	return $mailBoxService->setAsDefault( $id );
197	200	}
198	201
199	202	/**
200		- * This `getTickets` method will return the list of tickets for a business box
201	203	* @param Request $request
202		- * @param MailBox $mailBox
	204	+ * @param MailBoxService $mailBoxService
203	205	* @param int $id
204	206	* @return array
205	207	*/
206	208	public function getTickets(Request $request, MailBoxService $mailBoxService, $id)
		@@ -218,10 +220,8 @@
218	220	return $mailBoxService->getTickets( $filters, $id );
219	221	}
220	222
221	223	/**
222		- * Sanitize mailbox data array
223		- *
224	224	* @param mixed $data
225	225	* @return array
226	226	*/
227	227	private function sanitizeMailboxData($data)
		@@ -238,12 +238,11 @@
238	238	'email_footer' => isset($data['email_footer']) ? wp_kses_post($data['email_footer']) : '',
239	239	'is_default' => isset($data['is_default']) ? sanitize_text_field($data['is_default']) : 'no',
240	240	];
241	241
242		- // Handle nested settings array
243	242	if (isset($data['settings']) && is_array($data['settings'])) {
244	243	$sanitized['settings'] = map_deep($data['settings'], 'sanitize_text_field');
245		- // Preserve email in settings
	244	+ // Re-sanitize as an email, not plain text.
246	245	if (isset($data['settings']['admin_email_address'])) {
247	246	$sanitized['settings']['admin_email_address'] = sanitize_email($data['settings']['admin_email_address']);
248	247	}
249	248	}