← All changes
|
backend/src/Controllers/Form/DeleteFormsController.php
+23
-6
1.1.1
→
1.5.1
View file →
| @@ -11,8 +11,9 @@ | ||
| 11 | 11 | use IvyForms\Services\Entry\EntryService; |
| 12 | 12 | use IvyForms\Services\Field\FieldService; |
| 13 | 13 | use IvyForms\Services\Form\FormService; |
| 14 | 14 | use IvyForms\Services\Notification\NotificationService; |
| 15 | +use IvyForms\Services\Permissions\RoutePermissionService; | |
| 15 | 16 | use IvyForms\Services\Translations\BackendStrings; |
| 16 | 17 | use WP_REST_Request; |
| 17 | 18 | use WP_REST_Response; |
| 18 | 19 | |
| @@ -23,20 +24,24 @@ | ||
| 23 | 24 | private NotificationService $notificationService; |
| 24 | 25 | private ConfirmationService $confirmationService; |
| 25 | 26 | private EntryService $entryService; |
| 26 | 27 | |
| 28 | + private RoutePermissionService $routePermissionService; | |
| 29 | + | |
| 27 | 30 | public function __construct( |
| 28 | 31 | FormService $formService, |
| 29 | 32 | FieldService $fieldService, |
| 30 | 33 | NotificationService $notificationService, |
| 31 | 34 | ConfirmationService $confirmationService, |
| 32 | - EntryService $entryService | |
| 35 | + EntryService $entryService, | |
| 36 | + RoutePermissionService $routePermissionService | |
| 33 | 37 | ) { |
| 34 | - $this->formService = $formService; | |
| 35 | - $this->fieldService = $fieldService; | |
| 36 | - $this->notificationService = $notificationService; | |
| 37 | - $this->confirmationService = $confirmationService; | |
| 38 | - $this->entryService = $entryService; | |
| 38 | + $this->formService = $formService; | |
| 39 | + $this->fieldService = $fieldService; | |
| 40 | + $this->notificationService = $notificationService; | |
| 41 | + $this->confirmationService = $confirmationService; | |
| 42 | + $this->entryService = $entryService; | |
| 43 | + $this->routePermissionService = $routePermissionService; | |
| 39 | 44 | } |
| 40 | 45 | |
| 41 | 46 | /** |
| 42 | 47 | * Delete forms by IDs |
| @@ -61,8 +66,20 @@ | ||
| 61 | 66 | ); |
| 62 | 67 | } |
| 63 | 68 | |
| 64 | 69 | $ids = Sanitizer::sanitizeIds($data->get_param('ids')); |
| 70 | + if ($ids === []) { | |
| 71 | + return new WP_REST_Response([ | |
| 72 | + 'success' => false, | |
| 73 | + 'message' => BackendStrings::getExceptionStrings()['invalid_or_missing_ids'], | |
| 74 | + ], 400); | |
| 75 | + } | |
| 76 | + | |
| 77 | + foreach ($ids as $formId) { | |
| 78 | + if (!$this->routePermissionService->canDeleteForms((int) $formId)) { | |
| 79 | + throw new ForbiddenException('forbidden'); | |
| 80 | + } | |
| 81 | + } | |
| 65 | 82 | |
| 66 | 83 | $this->entryService->getDeletionManager()->deleteEntriesByFormIds($ids); |
| 67 | 84 | $this->confirmationService->deleteConfirmationsByFormIds($ids); |
| 68 | 85 | $this->notificationService->deleteNotificationsByFormIds($ids); |