← All changes | backend/src/Controllers/Entry/SearchEntriesController.php +21 -2 1.1 → 1.5.1 View file →

		@@ -13,8 +13,11 @@
13	13	use IvyForms\Common\Sanitizer\Sanitizer;
14	14	use IvyForms\Controllers\Controller;
15	15	use IvyForms\Factory\Entry\EntryFactory;
16	16	use IvyForms\Services\Entry\EntryService;
	17	+use IvyForms\Services\Form\FormService;
	18	+use IvyForms\Services\Permissions\AdminFormListPermissionService;
	19	+use IvyForms\Services\Permissions\IvyFormsAccess;
17	20	use IvyForms\Services\Translations\BackendStrings;
18	21	use WP_REST_Request;
19	22	use WP_REST_Response;
20	23
		@@ -21,12 +24,20 @@
21	24	class SearchEntriesController extends Controller
22	25	{
23	26	private EntryService $entryService;
24	27
	28	+ private FormService $formService;
	29	+
	30	+ private AdminFormListPermissionService $adminFormListPermissionService;
	31	+
25	32	public function __construct(
26		- EntryService $entryService
	33	+ EntryService $entryService,
	34	+ FormService $formService,
	35	+ AdminFormListPermissionService $adminFormListPermissionService
27	36	) {
28		- $this->entryService = $entryService;
	37	+ $this->entryService = $entryService;
	38	+ $this->formService = $formService;
	39	+ $this->adminFormListPermissionService = $adminFormListPermissionService;
29	40	}
30	41
31	42	/**
32	43	* @param WP_REST_Request $data
		@@ -42,8 +53,16 @@
42	53	Sanitizer::verifyNonce($data->get_header('X-WP-Nonce'));
43	54
44	55	// Sanitize the filtering data
45	56	$params = Sanitizer::sanitizeSearchParams($data->get_query_params());
	57	+
	58	+ if (!IvyFormsAccess::hasImplicitElevatedAccess()) {
	59	+ $allIdsUnique = $this->formService->getAllFormIds();
	60	+ $visibleIds = $this->adminFormListPermissionService->filterFormIdsVisibleInEntryLists($allIdsUnique);
	61	+ if ($visibleIds !== $allIdsUnique) {
	62	+ $params['visibleFormIds'] = $visibleIds;
	63	+ }
	64	+ }
46	65
47	66	// Call the searchEntries method
48	67	$entriesArr = $this->entryService->getEntryManager()->searchEntries($params);
49	68