arcticsoftware/polarpress-pagebuilder
1
0
Fork 0
Code Issues Pull Requests Projects Wiki Activity

Removed permission checking as permissions are not implemented for the standalone pagebuilder codebase
Some checks are pending
linter / quality (push) Waiting to run
Details
tests / ci (push) Waiting to run
Details

Browse Source
This commit is contained in:
Helge-Mikael Nordgård 2025-05-05 19:26:20 +02:00
parent 19e2611eb3
commit afb8942c52
1 changed files with 11 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
app/Http/Controllers/Backend/PageBuilder.php
View File

@ -72,20 +72,13 @@ class PageBuilder extends Controller
Page::where('main', true)->update(['main' => false]); Page::where('main', true)->update(['main' => false]);
} }
// Check if user has permission to publish a page
$publish = false;
$user = Auth::user();
if ($user->hasRole('supervisor') || $user->hasRole('board')) {
$publish = $data['publish'];
}
$page = Page::create([ $page = Page::create([
'uuid' => Str::uuid(), 'uuid' => Str::uuid(),
'user_id' => Auth::id(), 'user_id' => Auth::id(),
'title' => $data['title'], 'title' => $data['title'],
'slug' => $slug, 'slug' => $slug,
'content' => $data['content'], 'content' => $data['content'],
'is_published' => $publish, 'is_published' => $data['publish'],
'main' => $data['mainpage'], 'main' => $data['mainpage'],
'linked' => $data['linked'], 'linked' => $data['linked'],
'linkorder' => $data['linkorder'], 'linkorder' => $data['linkorder'],
@ -108,12 +101,10 @@ class PageBuilder extends Controller
public function deleteLandingPage(DeleteRequest $request) { public function deleteLandingPage(DeleteRequest $request) {
$page = Page::findOrFail($request->id); $page = Page::findOrFail($request->id);
// Check if the user is the owner of the page // Check if the user is the owner of the page (removed permission checking for standalone pagebuilder code)
if (!Auth::user()->hasRole('supervisor') || !Auth::user()->hasRole('board')) { if (Auth::user()->id != $page->user_id) {
if (Auth::user()->id != $page->user_id) { return to_route('page-builder.index')
return to_route('page-builder.index') ->with('error', "Du er ikke forfatteren av denne siden og kan derfor ikke slette den.");
->with('error', "Du er ikke forfatteren av denne siden og kan derfor ikke slette den.");
}
} }
$page->delete(); $page->delete();
@ -174,12 +165,10 @@ class PageBuilder extends Controller
->with('page') ->with('page')
->firstOrFail(); ->firstOrFail();
// Check if the user is the owner of the current revision // Check if the user is the owner of the current revision (removed permission checking for standalone pagebuilder code
if (!Auth::user()->hasRole('supervisor') || !Auth::user()->hasRole('board')) { if (Auth::user()->id != $revision->user_id) {
if (Auth::user()->id != $revision->user_id) { return to_route('page-builder.builder.edit', ['pageVersion' => $revision->uuid])
return to_route('page-builder.builder.edit', ['pageVersion' => $revision->uuid]) ->with('info', "Du er ikke forfatteren av denne revisjonen og kan derfor ikke gjøre endringer til den. Hvis du ønsker å gjøre endringer, lagre denne revisjonen som en ny versjon.");
->with('info', "Du er ikke forfatteren av denne revisjonen og kan derfor ikke gjøre endringer til den. Hvis du ønsker å gjøre endringer, lagre denne revisjonen som en ny versjon.");
}
} }
// If this page should be the main page, unset main on others // If this page should be the main page, unset main on others
@ -187,8 +176,8 @@ class PageBuilder extends Controller
Page::where('main', true)->where('id', '!=', $revision->page_id)->update(['main' => false]); Page::where('main', true)->where('id', '!=', $revision->page_id)->update(['main' => false]);
} }
// Check if user can publish // Check if user can publish (removed permission checking for standalone pagebuilder code
$canPublish = Auth::user()->hasRole('supervisor') || Auth::user()->hasRole('board'); $canPublish = true;
$publish = $canPublish ? $data['publish'] : false; $publish = $canPublish ? $data['publish'] : false;
if ($revision->active) { if ($revision->active) {
@ -256,12 +245,6 @@ class PageBuilder extends Controller
public function setLandingPageRevisionActive(SetActiveRequest $request) { public function setLandingPageRevisionActive(SetActiveRequest $request) {
$revision = PageRevision::where('uuid', $request->input('revision_uuid'))->firstOrFail(); $revision = PageRevision::where('uuid', $request->input('revision_uuid'))->firstOrFail();
if (!Auth::user()->hasRole('supervisor')) {
if (!Auth::user()->hasRole('board')) {
return to_route('page-builder.builder.edit', ['pageVersion' => $revision->uuid])
->with('error', "Du mangler tillatelse til å sette denne revisjonen som aktiv");
}
}
$data = $request->validated(); $data = $request->validated();