← All changes
|
backend/src/Controllers/Form/SearchFormsController.php
+19
-8
0.6.1.1
→
1.5
View file →
| @@ -6,13 +6,8 @@ | ||
| 6 | 6 | */ |
| 7 | 7 | |
| 8 | 8 | namespace IvyForms\Controllers\Form; |
| 9 | 9 | |
| 10 | -// phpcs:disable PSR1.Files.SideEffects | |
| 11 | -if (!defined('ABSPATH')) { | |
| 12 | - exit; // Exit if accessed directly | |
| 13 | -} | |
| 14 | - | |
| 15 | 10 | use IvyForms\Common\Exceptions\ForbiddenException; |
| 16 | 11 | use IvyForms\Common\Exceptions\InvalidArgumentException; |
| 17 | 12 | use IvyForms\Common\Sanitizer\Sanitizer; |
| 18 | 13 | use IvyForms\Controllers\Controller; |
| @@ -17,8 +12,10 @@ | ||
| 17 | 12 | use IvyForms\Common\Sanitizer\Sanitizer; |
| 18 | 13 | use IvyForms\Controllers\Controller; |
| 19 | 14 | use IvyForms\Services\Entry\EntryService; |
| 20 | 15 | use IvyForms\Services\Form\FormService; |
| 16 | +use IvyForms\Services\Permissions\AdminFormListPermissionService; | |
| 17 | +use IvyForms\Services\Permissions\IvyFormsAccess; | |
| 21 | 18 | use IvyForms\Services\Translations\BackendStrings; |
| 22 | 19 | use WP_REST_Request; |
| 23 | 20 | use WP_REST_Response; |
| 24 | 21 | |
| @@ -24,15 +21,21 @@ | ||
| 24 | 21 | |
| 25 | 22 | class SearchFormsController extends Controller |
| 26 | 23 | { |
| 27 | 24 | private FormService $formService; |
| 25 | + | |
| 28 | 26 | private EntryService $entryService; |
| 27 | + | |
| 28 | + private AdminFormListPermissionService $adminFormListPermissionService; | |
| 29 | + | |
| 29 | 30 | public function __construct( |
| 30 | 31 | FormService $formService, |
| 31 | - EntryService $entryService | |
| 32 | + EntryService $entryService, | |
| 33 | + AdminFormListPermissionService $adminFormListPermissionService | |
| 32 | 34 | ) { |
| 33 | - $this->formService = $formService; | |
| 34 | - $this->entryService = $entryService; | |
| 35 | + $this->formService = $formService; | |
| 36 | + $this->entryService = $entryService; | |
| 37 | + $this->adminFormListPermissionService = $adminFormListPermissionService; | |
| 35 | 38 | } |
| 36 | 39 | |
| 37 | 40 | /** |
| 38 | 41 | * @param WP_REST_Request $data |
| @@ -47,8 +50,16 @@ | ||
| 47 | 50 | Sanitizer::verifyNonce($data->get_header('X-WP-Nonce')); |
| 48 | 51 | |
| 49 | 52 | // Sanitize the filtering data |
| 50 | 53 | $params = Sanitizer::sanitizeSearchParams($data->get_query_params()); |
| 54 | + | |
| 55 | + if (!IvyFormsAccess::hasImplicitElevatedAccess()) { | |
| 56 | + $allIdsUnique = $this->formService->getAllFormIds(); | |
| 57 | + $visibleIds = $this->adminFormListPermissionService->filterFormIdsVisibleInAdminLists($allIdsUnique); | |
| 58 | + if ($visibleIds !== $allIdsUnique) { | |
| 59 | + $params['visibleFormIds'] = $visibleIds; | |
| 60 | + } | |
| 61 | + } | |
| 51 | 62 | |
| 52 | 63 | // Call the searchForms method |
| 53 | 64 | $formsArr = $this->formService->searchForms($params); |
| 54 | 65 | |