← All changes
|
backend/src/Controllers/Form/DeleteFormsController.php
+23
-11
0.8.2
→
1.5.1
View file →
| @@ -1,13 +1,8 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | |
| 3 | 3 | namespace IvyForms\Controllers\Form; |
| 4 | 4 | |
| 5 | -// phpcs:disable PSR1.Files.SideEffects | |
| 6 | -if (!defined('ABSPATH')) { | |
| 7 | - exit; // Exit if accessed directly | |
| 8 | -} | |
| 9 | - | |
| 10 | 5 | use IvyForms\Common\Exceptions\ForbiddenException; |
| 11 | 6 | use IvyForms\Common\Exceptions\InvalidArgumentException; |
| 12 | 7 | use IvyForms\Common\Exceptions\QueryExecutionException; |
| 13 | 8 | use IvyForms\Common\Sanitizer\Sanitizer; |
| @@ -16,8 +11,9 @@ | ||
| 16 | 11 | use IvyForms\Services\Entry\EntryService; |
| 17 | 12 | use IvyForms\Services\Field\FieldService; |
| 18 | 13 | use IvyForms\Services\Form\FormService; |
| 19 | 14 | use IvyForms\Services\Notification\NotificationService; |
| 15 | +use IvyForms\Services\Permissions\RoutePermissionService; | |
| 20 | 16 | use IvyForms\Services\Translations\BackendStrings; |
| 21 | 17 | use WP_REST_Request; |
| 22 | 18 | use WP_REST_Response; |
| 23 | 19 | |
| @@ -28,20 +24,24 @@ | ||
| 28 | 24 | private NotificationService $notificationService; |
| 29 | 25 | private ConfirmationService $confirmationService; |
| 30 | 26 | private EntryService $entryService; |
| 31 | 27 | |
| 28 | + private RoutePermissionService $routePermissionService; | |
| 29 | + | |
| 32 | 30 | public function __construct( |
| 33 | 31 | FormService $formService, |
| 34 | 32 | FieldService $fieldService, |
| 35 | 33 | NotificationService $notificationService, |
| 36 | 34 | ConfirmationService $confirmationService, |
| 37 | - EntryService $entryService | |
| 35 | + EntryService $entryService, | |
| 36 | + RoutePermissionService $routePermissionService | |
| 38 | 37 | ) { |
| 39 | - $this->formService = $formService; | |
| 40 | - $this->fieldService = $fieldService; | |
| 41 | - $this->notificationService = $notificationService; | |
| 42 | - $this->confirmationService = $confirmationService; | |
| 43 | - $this->entryService = $entryService; | |
| 38 | + $this->formService = $formService; | |
| 39 | + $this->fieldService = $fieldService; | |
| 40 | + $this->notificationService = $notificationService; | |
| 41 | + $this->confirmationService = $confirmationService; | |
| 42 | + $this->entryService = $entryService; | |
| 43 | + $this->routePermissionService = $routePermissionService; | |
| 44 | 44 | } |
| 45 | 45 | |
| 46 | 46 | /** |
| 47 | 47 | * Delete forms by IDs |
| @@ -66,8 +66,20 @@ | ||
| 66 | 66 | ); |
| 67 | 67 | } |
| 68 | 68 | |
| 69 | 69 | $ids = Sanitizer::sanitizeIds($data->get_param('ids')); |
| 70 | + if ($ids === []) { | |
| 71 | + return new WP_REST_Response([ | |
| 72 | + 'success' => false, | |
| 73 | + 'message' => BackendStrings::getExceptionStrings()['invalid_or_missing_ids'], | |
| 74 | + ], 400); | |
| 75 | + } | |
| 76 | + | |
| 77 | + foreach ($ids as $formId) { | |
| 78 | + if (!$this->routePermissionService->canDeleteForms((int) $formId)) { | |
| 79 | + throw new ForbiddenException('forbidden'); | |
| 80 | + } | |
| 81 | + } | |
| 70 | 82 | |
| 71 | 83 | $this->entryService->getDeletionManager()->deleteEntriesByFormIds($ids); |
| 72 | 84 | $this->confirmationService->deleteConfirmationsByFormIds($ids); |
| 73 | 85 | $this->notificationService->deleteNotificationsByFormIds($ids); |