| @@ -4,8 +4,9 @@ | ||
| 4 | 4 | |
| 5 | 5 | use Exception; |
| 6 | 6 | use FluentForm\App\Models\Submission; |
| 7 | 7 | use FluentForm\App\Modules\Acl\Acl; |
| 8 | +use FluentForm\App\Services\Manager\FormManagerService; | |
| 8 | 9 | use FluentForm\App\Services\Submission\SubmissionService; |
| 9 | 10 | use FluentForm\Framework\Support\Arr; |
| 10 | 11 | |
| 11 | 12 | class SubmissionController extends Controller |
| @@ -154,12 +155,19 @@ | ||
| 154 | 155 | if (!current_user_can('list_users') && !current_user_can('fluentform_manage_entries')) { |
| 155 | 156 | return $this->sendError(['message' => __('You do not have permission to list users.', 'fluentform')], 403); |
| 156 | 157 | } |
| 157 | 158 | $search = sanitize_text_field($this->request->get('search')); |
| 158 | - $users = get_users([ | |
| 159 | - 'search' => "*{$search}*", | |
| 160 | - 'number' => 50, | |
| 161 | - ]); | |
| 159 | + if (current_user_can('list_users')) { | |
| 160 | + $users = get_users([ | |
| 161 | + 'search' => "*{$search}*", | |
| 162 | + 'number' => 50, | |
| 163 | + ]); | |
| 164 | + } else { | |
| 165 | + // A delegated entries manager may confirm an address they already know, | |
| 166 | + // but must not browse the site's user roster (FF-SEC-45). | |
| 167 | + $user = is_email($search) ? get_user_by('email', $search) : false; | |
| 168 | + $users = $user ? [$user] : []; | |
| 169 | + } | |
| 162 | 170 | |
| 163 | 171 | $formattedUsers = []; |
| 164 | 172 | foreach ($users as $user) { |
| 165 | 173 | $formattedUsers[] = [ |
| @@ -242,8 +250,15 @@ | ||
| 242 | 250 | $entryIds = $attributes['entry_ids']; |
| 243 | 251 | $attributes['submission_ids'] = is_array($entryIds) |
| 244 | 252 | ? array_map('intval', $entryIds) |
| 245 | 253 | : []; |
| 254 | + } | |
| 255 | + | |
| 256 | + // Re-verify against the form actually printed; the policy scopes on a request entry_id. | |
| 257 | + if (!FormManagerService::hasFormPermission((int) Arr::get($attributes, 'form_id'))) { | |
| 258 | + return $this->sendError([ | |
| 259 | + 'message' => __('You do not have permission to view this form\'s entries.', 'fluentform'), | |
| 260 | + ], 403); | |
| 246 | 261 | } |
| 247 | 262 | |
| 248 | 263 | return $this->sendSuccess( |
| 249 | 264 | $submissionService->getPrintContent($attributes) |
