← All changes | backend/src/Controllers/Form/SearchFormsController.php +19 -3 1.0 → 1.5.1 View file →

		@@ -12,8 +12,10 @@
12	12	use IvyForms\Common\Sanitizer\Sanitizer;
13	13	use IvyForms\Controllers\Controller;
14	14	use IvyForms\Services\Entry\EntryService;
15	15	use IvyForms\Services\Form\FormService;
	16	+use IvyForms\Services\Permissions\AdminFormListPermissionService;
	17	+use IvyForms\Services\Permissions\IvyFormsAccess;
16	18	use IvyForms\Services\Translations\BackendStrings;
17	19	use WP_REST_Request;
18	20	use WP_REST_Response;
19	21
		@@ -19,15 +21,21 @@
19	21
20	22	class SearchFormsController extends Controller
21	23	{
22	24	private FormService $formService;
	25	+
23	26	private EntryService $entryService;
	27	+
	28	+ private AdminFormListPermissionService $adminFormListPermissionService;
	29	+
24	30	public function __construct(
25	31	FormService $formService,
26		- EntryService $entryService
	32	+ EntryService $entryService,
	33	+ AdminFormListPermissionService $adminFormListPermissionService
27	34	) {
28		- $this->formService = $formService;
29		- $this->entryService = $entryService;
	35	+ $this->formService = $formService;
	36	+ $this->entryService = $entryService;
	37	+ $this->adminFormListPermissionService = $adminFormListPermissionService;
30	38	}
31	39
32	40	/**
33	41	* @param WP_REST_Request $data
		@@ -42,8 +50,16 @@
42	50	Sanitizer::verifyNonce($data->get_header('X-WP-Nonce'));
43	51
44	52	// Sanitize the filtering data
45	53	$params = Sanitizer::sanitizeSearchParams($data->get_query_params());
	54	+
	55	+ if (!IvyFormsAccess::hasImplicitElevatedAccess()) {
	56	+ $allIdsUnique = $this->formService->getAllFormIds();
	57	+ $visibleIds = $this->adminFormListPermissionService->filterFormIdsVisibleInAdminLists($allIdsUnique);
	58	+ if ($visibleIds !== $allIdsUnique) {
	59	+ $params['visibleFormIds'] = $visibleIds;
	60	+ }
	61	+ }
46	62
47	63	// Call the searchForms method
48	64	$formsArr = $this->formService->searchForms($params);
49	65