← All changes | app/Services/Manager/ManagerService.php +18 -1 6.2.8 → 6.2.14 View file →

		@@ -88,14 +88,17 @@
88	88
89	89	$hasSpecificFormsPermission = 'yes' === Arr::get($manager, 'has_specific_forms_permission');
90	90	$allowedForms = array_values(array_filter(array_map('intval', (array) Arr::get($manager, 'forms', []))));
91	91
	92	+ // The UI always sends this flag, so an absent one is a partial payload, not a request to clear.
	93	+ $restrictionWasSubmitted = null !== Arr::get($manager, 'has_specific_forms_permission');
	94	+
92	95	// Keep an empty selection unrestricted so the manager UI's
93	96	// "leave blank for all forms" behavior matches the saved ACL state.
94	97	if ($hasSpecificFormsPermission && $allowedForms) {
95	98	FormManagerService::updateHasSpecificFormsPermission($user->ID, 'yes');
96	99	FormManagerService::addUserAllowedForms($allowedForms, $user->ID);
97		- } else {
	100	+ } elseif ($restrictionWasSubmitted) {
98	101	FormManagerService::updateHasSpecificFormsPermission($user->ID, 'no');
99	102	FormManagerService::deleteUserAllowedForms($user->ID);
100	103	}
101	104
		@@ -120,8 +123,22 @@
120	123
121	124	if (!$user) {
122	125	return ([
123	126	'message' => __('Associate user could not be found', 'fluentform'),
	127	+ ]);
	128	+ }
	129	+
	130	+ // Removal deletes _fluent_forms_has_role, which is what suppresses the role fallback.
	131	+ if (get_current_user_id() === $user->ID) {
	132	+ return ([
	133	+ 'message' => __('You cannot remove yourself as a manager.', 'fluentform'),
	134	+ ]);
	135	+ }
	136	+
	137	+ // Mirrors the grant-side guard at :73.
	138	+ if (in_array('fluentform_full_access', (array) Acl::getUserPermissions($user), true) && !current_user_can('manage_options')) {
	139	+ return ([
	140	+ 'message' => __('You do not have permission to remove a full access manager.', 'fluentform'),
124	141	]);
125	142	}
126	143
127	144	Acl::attachPermissions($user, []);