← All changes | backend/src/Controllers/Form/SearchFormsController.php +20 -9 0.6 → 1.5 View file →

		@@ -1,18 +1,13 @@
1	1	<?php
2	2
3	3	/**
4		- * @copyright © TMS-Plugins. All rights reserved.
	4	+ * @copyright © Melograno Venture Studio. All rights reserved.
5	5	* @licence See COPYING.md for license details.
6	6	*/
7	7
8	8	namespace IvyForms\Controllers\Form;
9	9
10		-// phpcs:disable PSR1.Files.SideEffects
11		-if (!defined('ABSPATH')) {
12		- exit; // Exit if accessed directly
13		-}
14		-
15	10	use IvyForms\Common\Exceptions\ForbiddenException;
16	11	use IvyForms\Common\Exceptions\InvalidArgumentException;
17	12	use IvyForms\Common\Sanitizer\Sanitizer;
18	13	use IvyForms\Controllers\Controller;
		@@ -17,8 +12,10 @@
17	12	use IvyForms\Common\Sanitizer\Sanitizer;
18	13	use IvyForms\Controllers\Controller;
19	14	use IvyForms\Services\Entry\EntryService;
20	15	use IvyForms\Services\Form\FormService;
	16	+use IvyForms\Services\Permissions\AdminFormListPermissionService;
	17	+use IvyForms\Services\Permissions\IvyFormsAccess;
21	18	use IvyForms\Services\Translations\BackendStrings;
22	19	use WP_REST_Request;
23	20	use WP_REST_Response;
24	21
		@@ -24,15 +21,21 @@
24	21
25	22	class SearchFormsController extends Controller
26	23	{
27	24	private FormService $formService;
	25	+
28	26	private EntryService $entryService;
	27	+
	28	+ private AdminFormListPermissionService $adminFormListPermissionService;
	29	+
29	30	public function __construct(
30	31	FormService $formService,
31		- EntryService $entryService
	32	+ EntryService $entryService,
	33	+ AdminFormListPermissionService $adminFormListPermissionService
32	34	) {
33		- $this->formService = $formService;
34		- $this->entryService = $entryService;
	35	+ $this->formService = $formService;
	36	+ $this->entryService = $entryService;
	37	+ $this->adminFormListPermissionService = $adminFormListPermissionService;
35	38	}
36	39
37	40	/**
38	41	* @param WP_REST_Request $data
		@@ -47,8 +50,16 @@
47	50	Sanitizer::verifyNonce($data->get_header('X-WP-Nonce'));
48	51
49	52	// Sanitize the filtering data
50	53	$params = Sanitizer::sanitizeSearchParams($data->get_query_params());
	54	+
	55	+ if (!IvyFormsAccess::hasImplicitElevatedAccess()) {
	56	+ $allIdsUnique = $this->formService->getAllFormIds();
	57	+ $visibleIds = $this->adminFormListPermissionService->filterFormIdsVisibleInAdminLists($allIdsUnique);
	58	+ if ($visibleIds !== $allIdsUnique) {
	59	+ $params['visibleFormIds'] = $visibleIds;
	60	+ }
	61	+ }
51	62
52	63	// Call the searchForms method
53	64	$formsArr = $this->formService->searchForms($params);
54	65