128 lines
5.1 KiB
PHP
128 lines
5.1 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace Leantime\Domain\Blueprints\Controllers;
|
|
|
|
use Leantime\Core\Auth\Permissions\RequiresPermission;
|
|
use Leantime\Core\Controller\Frontcontroller;
|
|
use Leantime\Core\Http\IncomingRequest;
|
|
use Leantime\Core\Language;
|
|
use Leantime\Core\UI\Template;
|
|
use Leantime\Domain\Blueprints\Models\CanvasTemplate;
|
|
use Leantime\Domain\Blueprints\Permissions\BlueprintsPermissions;
|
|
use Leantime\Domain\Blueprints\Repositories\Blueprints as BlueprintsRepository;
|
|
use Leantime\Domain\Blueprints\Services\Blueprints as BlueprintsService;
|
|
use Leantime\Domain\Blueprints\Services\TemplateRegistry;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
|
|
/**
|
|
* DelCanvas controller - handles canvas board deletion.
|
|
*
|
|
* Native Laravel controller: route-bound actions, the {canvasSlug}/{id} path segments
|
|
* arrive via the route (canvasSlug resolved in the constructor, id as a typed action arg),
|
|
* and request input is read from the injected IncomingRequest instead of the legacy
|
|
* merged-$params argument and superglobals.
|
|
*/
|
|
class DelCanvas
|
|
{
|
|
private string $canvasSlug;
|
|
|
|
private ?CanvasTemplate $template;
|
|
|
|
public function __construct(
|
|
private IncomingRequest $request,
|
|
private Template $tpl,
|
|
private Language $language,
|
|
private BlueprintsService $blueprintsService,
|
|
private BlueprintsRepository $blueprintsRepo,
|
|
TemplateRegistry $templateRegistry,
|
|
) {
|
|
$this->canvasSlug = strip_tags((string) ($request->route('canvasSlug') ?? ''));
|
|
$this->template = $templateRegistry->get($this->canvasSlug);
|
|
}
|
|
|
|
/**
|
|
* get - display the delete confirmation dialog.
|
|
*
|
|
* @param string|null $canvasSlug Canvas type slug from the route (resolved in the constructor)
|
|
* @param string|null $id Board id from the route
|
|
*/
|
|
#[RequiresPermission(BlueprintsPermissions::DELETE)]
|
|
public function get(?string $canvasSlug = null, ?string $id = null): Response
|
|
{
|
|
if ($this->template === null) {
|
|
return $this->tpl->displayPartial('errors.error404');
|
|
}
|
|
|
|
// The route id is optional in the pattern but mandatory in practice: every caller
|
|
// links with a concrete id. Validate strictly rather than sanitising — FILTER_SANITIZE_NUMBER_INT
|
|
// lets "1-2" through, which a later (int) cast would silently read as 1 and act on the
|
|
// wrong record. Fail closed instead.
|
|
$canvasId = filter_var($id, FILTER_VALIDATE_INT, ['options' => ['min_range' => 1]]);
|
|
|
|
if ($canvasId === false) {
|
|
return $this->tpl->displayPartial('errors.error404');
|
|
}
|
|
|
|
$this->tpl->assign('canvasSlug', $this->canvasSlug);
|
|
$this->tpl->assign('id', $canvasId);
|
|
|
|
return $this->tpl->displayPartial('blueprints.delCanvas');
|
|
}
|
|
|
|
/**
|
|
* post - process the board deletion.
|
|
*
|
|
* @param string|null $canvasSlug Canvas type slug from the route (resolved in the constructor)
|
|
* @param string|null $id Board id from the route
|
|
*/
|
|
#[RequiresPermission(BlueprintsPermissions::DELETE, entityScoped: true)]
|
|
public function post(?string $canvasSlug = null, ?string $id = null): Response
|
|
{
|
|
if ($this->template === null) {
|
|
return $this->tpl->displayPartial('errors.error404');
|
|
}
|
|
|
|
// The route id is optional in the pattern but mandatory in practice: every caller
|
|
// links with a concrete id. Validate strictly rather than sanitising — FILTER_SANITIZE_NUMBER_INT
|
|
// lets "1-2" through, which a later (int) cast would silently read as 1 and act on the
|
|
// wrong record. Fail closed instead.
|
|
$canvasId = filter_var($id, FILTER_VALIDATE_INT, ['options' => ['min_range' => 1]]);
|
|
|
|
if ($canvasId === false) {
|
|
return $this->tpl->displayPartial('errors.error404');
|
|
}
|
|
|
|
$canvasType = $this->template->getDatabaseType();
|
|
$sessionKey = $this->template->getSessionKey();
|
|
|
|
if ($this->request->has('del')) {
|
|
// The service resolves the board's REAL project and authorizes DELETE against it
|
|
// (throwing 403 for a missing/foreign board) — closing the by-id board-delete IDOR
|
|
// that the previous role-only Auth::authOrRedirect left open.
|
|
$this->blueprintsService->deleteBoard($canvasId, $canvasType);
|
|
|
|
$allCanvas = $this->blueprintsRepo->getAllCanvas(session('currentProject'), $canvasType);
|
|
session([$sessionKey => $allCanvas[0]['id'] ?? -1]);
|
|
|
|
$this->tpl->setNotification(
|
|
$this->language->__('notification.board_deleted'),
|
|
'success',
|
|
strtoupper($this->canvasSlug).'canvas_deleted'
|
|
);
|
|
|
|
if (! $allCanvas) {
|
|
return Frontcontroller::redirect(BASE_URL.'/blueprints/showBoards');
|
|
}
|
|
|
|
return Frontcontroller::redirect(BASE_URL.'/blueprints/'.$this->canvasSlug.'/showCanvas');
|
|
}
|
|
|
|
$this->tpl->assign('canvasSlug', $this->canvasSlug);
|
|
$this->tpl->assign('id', $canvasId);
|
|
|
|
return $this->tpl->displayPartial('blueprints.delCanvas');
|
|
}
|
|
}
|