From 1fe20dcc1d1af337d8f72961fe368ec7ddeb4844 Mon Sep 17 00:00:00 2001
From: grnd-alt <salimbelakkaf@outlook.de>
Date: Thu, 7 Nov 2024 10:50:20 +0100
Subject: [PATCH] check user-permsisions when assigning to cloned card

Signed-off-by: grnd-alt <salimbelakkaf@outlook.de>
---
 lib/Service/CardService.php | 92 +++++++++++++------------------------
 1 file changed, 32 insertions(+), 60 deletions(-)

diff --git a/lib/Service/CardService.php b/lib/Service/CardService.php
index e93c9be0a..15f659df9 100644
--- a/lib/Service/CardService.php
+++ b/lib/Service/CardService.php
@@ -37,70 +37,33 @@ use OCP\IUserManager;
 use Psr\Log\LoggerInterface;
 
 class CardService {
-	private CardMapper $cardMapper;
-	private StackMapper $stackMapper;
-	private BoardMapper $boardMapper;
-	private LabelMapper $labelMapper;
-	private LabelService $labelService;
-	private PermissionService $permissionService;
-	private BoardService $boardService;
-	private NotificationHelper $notificationHelper;
-	private AssignmentMapper $assignedUsersMapper;
-	private AttachmentService $attachmentService;
-	private ?string $currentUser;
-	private ActivityManager $activityManager;
-	private ICommentsManager $commentsManager;
-	private ChangeHelper $changeHelper;
-	private IEventDispatcher $eventDispatcher;
-	private IUserManager $userManager;
-	private IURLGenerator $urlGenerator;
-	private LoggerInterface $logger;
-	private IRequest $request;
-	private CardServiceValidator $cardServiceValidator;
+
+	private string $currentUser;
 
 	public function __construct(
-		CardMapper $cardMapper,
-		StackMapper $stackMapper,
-		BoardMapper $boardMapper,
-		LabelMapper $labelMapper,
-		LabelService $labelService,
-		PermissionService $permissionService,
-		BoardService $boardService,
-		NotificationHelper $notificationHelper,
-		AssignmentMapper $assignedUsersMapper,
-		AttachmentService $attachmentService,
-		ActivityManager $activityManager,
-		ICommentsManager $commentsManager,
-		IUserManager $userManager,
-		ChangeHelper $changeHelper,
-		IEventDispatcher $eventDispatcher,
-		IURLGenerator $urlGenerator,
-		LoggerInterface $logger,
-		IRequest $request,
-		CardServiceValidator $cardServiceValidator,
+		private CardMapper $cardMapper,
+		private StackMapper $stackMapper,
+		private BoardMapper $boardMapper,
+		private LabelMapper $labelMapper,
+		private LabelService $labelService,
+		private PermissionService $permissionService,
+		private BoardService $boardService,
+		private NotificationHelper $notificationHelper,
+		private AssignmentMapper $assignedUsersMapper,
+		private AttachmentService $attachmentService,
+		private ActivityManager $activityManager,
+		private ICommentsManager $commentsManager,
+		private IUserManager $userManager,
+		private ChangeHelper $changeHelper,
+		private IEventDispatcher $eventDispatcher,
+		private IURLGenerator $urlGenerator,
+		private LoggerInterface $logger,
+		private IRequest $request,
+		private CardServiceValidator $cardServiceValidator,
 		private AssignmentService $assignmentService,
 		?string $userId,
 	) {
-		$this->cardMapper = $cardMapper;
-		$this->stackMapper = $stackMapper;
-		$this->boardMapper = $boardMapper;
-		$this->labelMapper = $labelMapper;
-		$this->labelService = $labelService;
-		$this->permissionService = $permissionService;
-		$this->boardService = $boardService;
-		$this->notificationHelper = $notificationHelper;
-		$this->assignedUsersMapper = $assignedUsersMapper;
-		$this->attachmentService = $attachmentService;
-		$this->activityManager = $activityManager;
-		$this->commentsManager = $commentsManager;
-		$this->userManager = $userManager;
-		$this->changeHelper = $changeHelper;
-		$this->eventDispatcher = $eventDispatcher;
 		$this->currentUser = $userId;
-		$this->urlGenerator = $urlGenerator;
-		$this->logger = $logger;
-		$this->request = $request;
-		$this->cardServiceValidator = $cardServiceValidator;
 	}
 
 	public function enrichCards($cards) {
@@ -395,7 +358,7 @@ class CardService {
 	public function cloneCard(int $id, ?int $targetStackId = null):Card {
 		$this->permissionService->checkPermission($this->cardMapper, $id, Acl::PERMISSION_READ);
 		$originCard = $this->cardMapper->find($id);
-		if ($targetStackId == null) {
+		if ($targetStackId === null) {
 			$targetStackId = $originCard->getStackId();
 		}
 		$this->permissionService->checkPermission($this->stackMapper, $targetStackId, Acl::PERMISSION_EDIT);
@@ -403,11 +366,20 @@ class CardService {
 		$boardId = $this->stackMapper->findBoardId($targetStackId);
 		foreach ($this->labelMapper->findAssignedLabelsForCard($id) as $label) {
 			if ($boardId != $this->stackMapper->findBoardId($originCard->getStackId())) {
-				$label = $this->labelService->cloneLabelIfNotExists($label->getId(), $boardId);
+				try {
+					$label = $this->labelService->cloneLabelIfNotExists($label->getId(), $boardId);
+				} catch (NoPermissionException $e) {
+					break;
+				}
 			}
 			$this->assignLabel($newCard->getId(), $label->getId());
 		}
 		foreach ($this->assignedUsersMapper->findAll($id) as $assignement) {
+			try {
+				$this->permissionService->checkPermission($this->cardMapper, $newCard->getId(), Acl::PERMISSION_READ, $assignement->getParticipant());
+			} catch (NoPermissionException $e) {
+				continue;
+			}
 			$this->assignmentService->assignUser($newCard->getId(), $assignement->getParticipant());
 		}
 		$newCard->setDescription($originCard->getDescription());