← All changes | backend/src/Controllers/Entry/BulkUpdateEntryController.php +30 -8 0.9 → 1.5.1 View file →

		@@ -1,17 +1,15 @@
1	1	<?php
2	2
3	3	namespace IvyForms\Controllers\Entry;
4	4
5		-// phpcs:disable PSR1.Files.SideEffects
6		-if (!defined('ABSPATH')) {
7		- exit; // Exit if accessed directly
8		-}
9		-
	5	+use IvyForms\Common\Exceptions\ForbiddenException;
10	6	use IvyForms\Common\Exceptions\InvalidArgumentException;
11	7	use IvyForms\Common\Sanitizer\Sanitizer;
12	8	use IvyForms\Controllers\Controller;
13	9	use IvyForms\Services\Entry\EntryService;
	10	+use IvyForms\Services\Permissions\PermissionResourceResolver;
	11	+use IvyForms\Services\Permissions\RoutePermissionService;
14	12	use IvyForms\Services\Translations\BackendStrings;
15	13	use WP_REST_Request;
16	14	use WP_REST_Response;
17	15
		@@ -23,11 +21,20 @@
23	21	class BulkUpdateEntryController extends Controller
24	22	{
25	23	private EntryService $entryService;
26	24
27		- public function __construct(EntryService $entryService)
28		- {
29		- $this->entryService = $entryService;
	25	+ private RoutePermissionService $routePermissionService;
	26	+
	27	+ private PermissionResourceResolver $permissionResourceResolver;
	28	+
	29	+ public function __construct(
	30	+ EntryService $entryService,
	31	+ RoutePermissionService $routePermissionService,
	32	+ PermissionResourceResolver $permissionResourceResolver
	33	+ ) {
	34	+ $this->entryService = $entryService;
	35	+ $this->routePermissionService = $routePermissionService;
	36	+ $this->permissionResourceResolver = $permissionResourceResolver;
30	37	}
31	38
32	39	/**
33	40	* Handle bulk update request for entries
		@@ -70,8 +77,23 @@
70	77	return new WP_REST_Response([
71	78	'success' => false,
72	79	'message' => BackendStrings::getExceptionStrings()['table_or_attribute_not_allowed'],
73	80	], 400);
	81	+ }
	82	+
	83	+ $formIdsByEntryId = $this->permissionResourceResolver->formIdsFromEntryIds($sanitized['ids']);
	84	+
	85	+ foreach ($sanitized['ids'] as $entryId) {
	86	+ $id = (int) $entryId;
	87	+ if (!isset($formIdsByEntryId[$id])) {
	88	+ throw new ForbiddenException('forbidden');
	89	+ }
	90	+ }
	91	+
	92	+ foreach (array_unique(array_values($formIdsByEntryId)) as $formId) {
	93	+ if (!$this->routePermissionService->canEditEntries($formId)) {
	94	+ throw new ForbiddenException('forbidden');
	95	+ }
74	96	}
75	97
76	98	$this->entryService->getEntryManager()->bulkUpdateColumn(
77	99	$sanitized['column'],