wbrawner/twigs-nextcloud
1
0
Fork 0
Code Issues Pull requests Projects Releases 3 Packages Wiki Activity Actions

Ensure user has permissions to modify budgets before chaning them

Browse source 
Signed-off-by: William Brawner <me@wbrawner.com>
This commit is contained in:
William Brawner 2020-03-07 19:34:15 -06:00
parent 37fa1e65f0
commit 3d3c464416
1 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
lib/Controller/BudgetController.php
View file

@ -12,6 +12,7 @@ use OCP\IRequest;
use OCP\AppFramework\Http\DataResponse;
use OCP\AppFramework\Controller;
use \OCP\ILogger;
use OCP\AppFramework\Http;
class BudgetController extends Controller
{
@ -87,6 +88,7 @@ class BudgetController extends Controller
$budget->setDescription($description);
$budget = $this->budgetMapper->insert($budget);
$userPermissions = [];
$users[$this->userId] = UserPermission::PERMISSION_MANAGE;
foreach ($users as $user => $permission) {
$userPermission = new UserPermission();
$userPermission->setBudgetId($budget->getId());
@ -116,6 +118,9 @@ class BudgetController extends Controller
} catch (Exception $e) {
return new DataResponse([], Http::STATUS_NOT_FOUND);
}
if ($userPermission->getPermission() != UserPermission::PERMISSION_MANAGE) {
return new DataResponse([], Http::STATUS_FORBIDDEN);
}
if ($name) {
$budget->setName($name);
}
@ -126,6 +131,7 @@ class BudgetController extends Controller
if ($users) {
$this->userPermissionMapper->deleteAll($budget->id);
$userPermissions = [];
$users[$this->userId] = UserPermission::PERMISSION_MANAGE;
foreach ($users as $user => $permission) {
$userPermission = new UserPermission();
$userPermission->setBudgetId($budget->getId());
@ -157,6 +163,9 @@ class BudgetController extends Controller
} catch (Exception $e) {
return new DataResponse([], Http::STATUS_NOT_FOUND);
}
if ($userPermission->getPermission() != UserPermission::PERMISSION_MANAGE) {
return new DataResponse([], Http::STATUS_FORBIDDEN);
}
// Delete all user permissions for this budget
$this->userPermissionMapper->deleteAll($budget->getId());
// Delete all transactions for this budget