← All changes | app/Http/Policies/ReportPolicy.php +27 -4 6.2.5 → 6.2.14 View file →

		@@ -55,8 +55,31 @@
55	55
56	56	return !$userId || !FormManagerService::hasSpecificFormsPermission($userId);
57	57	}
58	58
	59	+ private function canAccessPaymentReport(Request $request)
	60	+ {
	61	+ // Payment/revenue/subscription data requires the dedicated, form-scoped
	62	+ // payment-view capability — the entry-view capability must not authorize
	63	+ // financial aggregates.
	64	+ $formId = $this->resolveFormId($request);
	65	+
	66	+ if ($formId) {
	67	+ return Acl::hasPermission('fluentform_view_payments', $formId);
	68	+ }
	69	+
	70	+ if (!Acl::hasPermission('fluentform_view_payments')) {
	71	+ return false;
	72	+ }
	73	+
	74	+ // A specific-forms manager must NOT read the all-forms (form_id 0)
	75	+ // payment view — otherwise the per-form scope is bypassed by loading the
	76	+ // aggregate revenue/subscription report. Mirrors canAccessOptionalFormScopedReport.
	77	+ $userId = get_current_user_id();
	78	+
	79	+ return !$userId || !FormManagerService::hasSpecificFormsPermission($userId);
	80	+ }
	81	+
59	82	/**
60	83	* Check permission for any method
61	84	*
62	85	* @param \FluentForm\Framework\Request\Request $request
		@@ -83,9 +106,9 @@
83	106	}
84	107
85	108	public function getRevenueChart(Request $request)
86	109	{
87		- return $this->canAccessRequestedForm($request);
	110	+ return $this->canAccessPaymentReport($request);
88	111	}
89	112
90	113	public function getFormStats(Request $request)
91	114	{
		@@ -98,9 +121,9 @@
98	121	}
99	122
100	123	public function getPaymentTypes(Request $request)
101	124	{
102		- return $this->canAccessRequestedForm($request);
	125	+ return $this->canAccessPaymentReport($request);
103	126	}
104	127
105	128	public function getCompletionRate(Request $request)
106	129	{
		@@ -123,9 +146,9 @@
123	146	}
124	147
125	148	public function getSubscriptions(Request $request)
126	149	{
127		- return $this->canAccessOptionalFormScopedReport($request);
	150	+ return $this->canAccessPaymentReport($request);
128	151	}
129	152
130	153	public function getFormsDropdown(Request $request)
131	154	{
		@@ -133,9 +156,9 @@
133	156	}
134	157
135	158	public function netRevenue(Request $request)
136	159	{
137		- return $this->canAccessOptionalFormScopedReport($request);
	160	+ return $this->canAccessPaymentReport($request);
138	161	}
139	162
140	163	public function submissionsAnalysis(Request $request)
141	164	{