← All changes
|
backend/src/Controllers/Entry/SearchEntriesController.php
+21
-7
0.8.2
→
1.5
View file →
| @@ -6,13 +6,8 @@ | ||
| 6 | 6 | */ |
| 7 | 7 | |
| 8 | 8 | namespace IvyForms\Controllers\Entry; |
| 9 | 9 | |
| 10 | -// phpcs:disable PSR1.Files.SideEffects | |
| 11 | -if (!defined('ABSPATH')) { | |
| 12 | - exit; // Exit if accessed directly | |
| 13 | -} | |
| 14 | - | |
| 15 | 10 | use IvyForms\Common\Exceptions\ForbiddenException; |
| 16 | 11 | use IvyForms\Common\Exceptions\InvalidArgumentException; |
| 17 | 12 | use IvyForms\Common\Exceptions\ValidationException; |
| 18 | 13 | use IvyForms\Common\Sanitizer\Sanitizer; |
| @@ -18,8 +13,11 @@ | ||
| 18 | 13 | use IvyForms\Common\Sanitizer\Sanitizer; |
| 19 | 14 | use IvyForms\Controllers\Controller; |
| 20 | 15 | use IvyForms\Factory\Entry\EntryFactory; |
| 21 | 16 | use IvyForms\Services\Entry\EntryService; |
| 17 | +use IvyForms\Services\Form\FormService; | |
| 18 | +use IvyForms\Services\Permissions\AdminFormListPermissionService; | |
| 19 | +use IvyForms\Services\Permissions\IvyFormsAccess; | |
| 22 | 20 | use IvyForms\Services\Translations\BackendStrings; |
| 23 | 21 | use WP_REST_Request; |
| 24 | 22 | use WP_REST_Response; |
| 25 | 23 | |
| @@ -26,12 +24,20 @@ | ||
| 26 | 24 | class SearchEntriesController extends Controller |
| 27 | 25 | { |
| 28 | 26 | private EntryService $entryService; |
| 29 | 27 | |
| 28 | + private FormService $formService; | |
| 29 | + | |
| 30 | + private AdminFormListPermissionService $adminFormListPermissionService; | |
| 31 | + | |
| 30 | 32 | public function __construct( |
| 31 | - EntryService $entryService | |
| 33 | + EntryService $entryService, | |
| 34 | + FormService $formService, | |
| 35 | + AdminFormListPermissionService $adminFormListPermissionService | |
| 32 | 36 | ) { |
| 33 | - $this->entryService = $entryService; | |
| 37 | + $this->entryService = $entryService; | |
| 38 | + $this->formService = $formService; | |
| 39 | + $this->adminFormListPermissionService = $adminFormListPermissionService; | |
| 34 | 40 | } |
| 35 | 41 | |
| 36 | 42 | /** |
| 37 | 43 | * @param WP_REST_Request $data |
| @@ -47,8 +53,16 @@ | ||
| 47 | 53 | Sanitizer::verifyNonce($data->get_header('X-WP-Nonce')); |
| 48 | 54 | |
| 49 | 55 | // Sanitize the filtering data |
| 50 | 56 | $params = Sanitizer::sanitizeSearchParams($data->get_query_params()); |
| 57 | + | |
| 58 | + if (!IvyFormsAccess::hasImplicitElevatedAccess()) { | |
| 59 | + $allIdsUnique = $this->formService->getAllFormIds(); | |
| 60 | + $visibleIds = $this->adminFormListPermissionService->filterFormIdsVisibleInEntryLists($allIdsUnique); | |
| 61 | + if ($visibleIds !== $allIdsUnique) { | |
| 62 | + $params['visibleFormIds'] = $visibleIds; | |
| 63 | + } | |
| 64 | + } | |
| 51 | 65 | |
| 52 | 66 | // Call the searchEntries method |
| 53 | 67 | $entriesArr = $this->entryService->getEntryManager()->searchEntries($params); |
| 54 | 68 | |