ahtlon/deck
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Properly check for the stack AND setting board permissions

Browse Source 
Signed-off-by: Julius Härtl <jus@bitgrid.net>
This commit is contained in:
Julius Härtl
2022-03-25 10:02:53 +01:00
parent 0ce4279d8f
commit 86d3de2211
2 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
lib/Service/StackService.php
View File

@@ -290,10 +290,13 @@ class StackService {
throw new BadRequestException('order must be a number');
}
$this->permissionService->checkPermission($this->stackMapper, $boardId, Acl::PERMISSION_MANAGE);
if ($this->boardService->isArchived($this->stackMapper, $boardId)) {
$this->permissionService->checkPermission($this->stackMapper, $id, Acl::PERMISSION_MANAGE);
$this->permissionService->checkPermission($this->boardMapper, $boardId, Acl::PERMISSION_MANAGE);
if ($this->boardService->isArchived($this->stackMapper, $id)) {
throw new StatusException('Operation not allowed. This board is archived.');
}
$stack = $this->stackMapper->find($id);
$changes = new ChangeSet($stack);
$stack->setTitle($title);

2
tests/unit/Service/StackServiceTest.php
View File

@@ -195,7 +195,7 @@ class StackServiceTest extends TestCase {
}
public function testUpdate() {
$this->permissionService->expects($this->once())->method('checkPermission');
$this->permissionService->expects($this->exactly(2))->method('checkPermission');
$stack = new Stack();
$this->stackMapper->expects($this->once())->method('find')->willReturn($stack);
$this->stackMapper->expects($this->once())->method('update')->willReturn($stack);