← All changes | backend/src/Controllers/Notification/DeleteNotificationsController.php +21 -3 1.1.1 → 1.5.1 View file →

		@@ -6,8 +6,10 @@
6	6	use IvyForms\Common\Exceptions\InvalidArgumentException;
7	7	use IvyForms\Controllers\Controller;
8	8	use IvyForms\Common\Sanitizer\Sanitizer;
9	9	use IvyForms\Services\Notification\NotificationService;
	10	+use IvyForms\Services\Permissions\PermissionResourceResolver;
	11	+use IvyForms\Services\Permissions\RoutePermissionService;
10	12	use IvyForms\Services\Translations\BackendStrings;
11	13	use WP_REST_Request;
12	14	use WP_REST_Response;
13	15
		@@ -19,11 +21,20 @@
19	21	class DeleteNotificationsController extends Controller
20	22	{
21	23	private NotificationService $notificationService;
22	24
23		- public function __construct(NotificationService $notificationService)
24		- {
25		- $this->notificationService = $notificationService;
	25	+ private RoutePermissionService $routePermissionService;
	26	+
	27	+ private PermissionResourceResolver $permissionResourceResolver;
	28	+
	29	+ public function __construct(
	30	+ NotificationService $notificationService,
	31	+ RoutePermissionService $routePermissionService,
	32	+ PermissionResourceResolver $permissionResourceResolver
	33	+ ) {
	34	+ $this->notificationService = $notificationService;
	35	+ $this->routePermissionService = $routePermissionService;
	36	+ $this->permissionResourceResolver = $permissionResourceResolver;
26	37	}
27	38
28	39	/**
29	40	* @param WP_REST_Request $data
		@@ -41,8 +52,15 @@
41	52	if (empty($notificationIds)) {
42	53	throw new InvalidArgumentException(
43	54	BackendStrings::getExceptionStrings()['notification_ids_required']
44	55	);
	56	+ }
	57	+
	58	+ foreach ($notificationIds as $notificationId) {
	59	+ $formId = $this->permissionResourceResolver->formIdFromNotificationId((int) $notificationId);
	60	+ if ($formId === null || !$this->routePermissionService->canEditForms($formId)) {
	61	+ throw new ForbiddenException('forbidden');
	62	+ }
45	63	}
46	64
47	65	$this->notificationService->deleteNotifications($notificationIds);
48	66