← All changes
|
backend/src/Controllers/Notification/DeleteNotificationsController.php
+21
-8
0.5
→
1.5
View file →
| @@ -1,18 +1,15 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | |
| 3 | 3 | namespace IvyForms\Controllers\Notification; |
| 4 | 4 | |
| 5 | -// phpcs:disable PSR1.Files.SideEffects | |
| 6 | -if (!defined('ABSPATH')) { | |
| 7 | - exit; // Exit if accessed directly | |
| 8 | -} | |
| 9 | - | |
| 10 | 5 | use IvyForms\Common\Exceptions\ForbiddenException; |
| 11 | 6 | use IvyForms\Common\Exceptions\InvalidArgumentException; |
| 12 | 7 | use IvyForms\Controllers\Controller; |
| 13 | 8 | use IvyForms\Common\Sanitizer\Sanitizer; |
| 14 | 9 | use IvyForms\Services\Notification\NotificationService; |
| 10 | +use IvyForms\Services\Permissions\PermissionResourceResolver; | |
| 11 | +use IvyForms\Services\Permissions\RoutePermissionService; | |
| 15 | 12 | use IvyForms\Services\Translations\BackendStrings; |
| 16 | 13 | use WP_REST_Request; |
| 17 | 14 | use WP_REST_Response; |
| 18 | 15 | |
| @@ -24,11 +21,20 @@ | ||
| 24 | 21 | class DeleteNotificationsController extends Controller |
| 25 | 22 | { |
| 26 | 23 | private NotificationService $notificationService; |
| 27 | 24 | |
| 28 | - public function __construct(NotificationService $notificationService) | |
| 29 | - { | |
| 30 | - $this->notificationService = $notificationService; | |
| 25 | + private RoutePermissionService $routePermissionService; | |
| 26 | + | |
| 27 | + private PermissionResourceResolver $permissionResourceResolver; | |
| 28 | + | |
| 29 | + public function __construct( | |
| 30 | + NotificationService $notificationService, | |
| 31 | + RoutePermissionService $routePermissionService, | |
| 32 | + PermissionResourceResolver $permissionResourceResolver | |
| 33 | + ) { | |
| 34 | + $this->notificationService = $notificationService; | |
| 35 | + $this->routePermissionService = $routePermissionService; | |
| 36 | + $this->permissionResourceResolver = $permissionResourceResolver; | |
| 31 | 37 | } |
| 32 | 38 | |
| 33 | 39 | /** |
| 34 | 40 | * @param WP_REST_Request $data |
| @@ -46,8 +52,15 @@ | ||
| 46 | 52 | if (empty($notificationIds)) { |
| 47 | 53 | throw new InvalidArgumentException( |
| 48 | 54 | BackendStrings::getExceptionStrings()['notification_ids_required'] |
| 49 | 55 | ); |
| 56 | + } | |
| 57 | + | |
| 58 | + foreach ($notificationIds as $notificationId) { | |
| 59 | + $formId = $this->permissionResourceResolver->formIdFromNotificationId((int) $notificationId); | |
| 60 | + if ($formId === null || !$this->routePermissionService->canEditForms($formId)) { | |
| 61 | + throw new ForbiddenException('forbidden'); | |
| 62 | + } | |
| 50 | 63 | } |
| 51 | 64 | |
| 52 | 65 | $this->notificationService->deleteNotifications($notificationIds); |
| 53 | 66 | |