← All changes
|
backend/src/Controllers/Entry/BulkUpdateEntryController.php
+30
-3
1.1
→
1.5.1
View file →
| @@ -1,12 +1,15 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | |
| 3 | 3 | namespace IvyForms\Controllers\Entry; |
| 4 | 4 | |
| 5 | +use IvyForms\Common\Exceptions\ForbiddenException; | |
| 5 | 6 | use IvyForms\Common\Exceptions\InvalidArgumentException; |
| 6 | 7 | use IvyForms\Common\Sanitizer\Sanitizer; |
| 7 | 8 | use IvyForms\Controllers\Controller; |
| 8 | 9 | use IvyForms\Services\Entry\EntryService; |
| 10 | +use IvyForms\Services\Permissions\PermissionResourceResolver; | |
| 11 | +use IvyForms\Services\Permissions\RoutePermissionService; | |
| 9 | 12 | use IvyForms\Services\Translations\BackendStrings; |
| 10 | 13 | use WP_REST_Request; |
| 11 | 14 | use WP_REST_Response; |
| 12 | 15 | |
| @@ -18,11 +21,20 @@ | ||
| 18 | 21 | class BulkUpdateEntryController extends Controller |
| 19 | 22 | { |
| 20 | 23 | private EntryService $entryService; |
| 21 | 24 | |
| 22 | - public function __construct(EntryService $entryService) | |
| 23 | - { | |
| 24 | - $this->entryService = $entryService; | |
| 25 | + private RoutePermissionService $routePermissionService; | |
| 26 | + | |
| 27 | + private PermissionResourceResolver $permissionResourceResolver; | |
| 28 | + | |
| 29 | + public function __construct( | |
| 30 | + EntryService $entryService, | |
| 31 | + RoutePermissionService $routePermissionService, | |
| 32 | + PermissionResourceResolver $permissionResourceResolver | |
| 33 | + ) { | |
| 34 | + $this->entryService = $entryService; | |
| 35 | + $this->routePermissionService = $routePermissionService; | |
| 36 | + $this->permissionResourceResolver = $permissionResourceResolver; | |
| 25 | 37 | } |
| 26 | 38 | |
| 27 | 39 | /** |
| 28 | 40 | * Handle bulk update request for entries |
| @@ -65,8 +77,23 @@ | ||
| 65 | 77 | return new WP_REST_Response([ |
| 66 | 78 | 'success' => false, |
| 67 | 79 | 'message' => BackendStrings::getExceptionStrings()['table_or_attribute_not_allowed'], |
| 68 | 80 | ], 400); |
| 81 | + } | |
| 82 | + | |
| 83 | + $formIdsByEntryId = $this->permissionResourceResolver->formIdsFromEntryIds($sanitized['ids']); | |
| 84 | + | |
| 85 | + foreach ($sanitized['ids'] as $entryId) { | |
| 86 | + $id = (int) $entryId; | |
| 87 | + if (!isset($formIdsByEntryId[$id])) { | |
| 88 | + throw new ForbiddenException('forbidden'); | |
| 89 | + } | |
| 90 | + } | |
| 91 | + | |
| 92 | + foreach (array_unique(array_values($formIdsByEntryId)) as $formId) { | |
| 93 | + if (!$this->routePermissionService->canEditEntries($formId)) { | |
| 94 | + throw new ForbiddenException('forbidden'); | |
| 95 | + } | |
| 69 | 96 | } |
| 70 | 97 | |
| 71 | 98 | $this->entryService->getEntryManager()->bulkUpdateColumn( |
| 72 | 99 | $sanitized['column'], |