copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Enforce department access in department lanes routes

Browse Source
This commit is contained in:
Jeppe B
2026-06-01 22:38:53 +02:00
parent d82c7d88ec
commit 300a37fce3
1 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/routes/departmentLanesRoute.php
+12 -2
View File
@@ -35,6 +35,7 @@ class departmentLanesRoute
// Return an error
$response->error('Department lane not found', 404);
}
self::requireDepartmentAccess((int)$department_lane->department->value());
// Log the incident
(new logs_o())->add('department_lanes', 'global', 1, $user->id, 'VIEW_DEPARTMENT_LANE', 'User viewed department lane with id ' . $department_lane->id);
// Return the department lane
@@ -63,7 +64,13 @@ class departmentLanesRoute
$department_lane_o = (new department_lanes_o())->select((int)$department_lane['id']);
// Return the object as an array
return $department_lane_o->asArray();
}
},
(new department_lanes_o())->forceRestrictFilters(
[
// This makes sure that the user can only see lanes from departments they explicitly have access to
'department' => $user->getGroup()->getDepartments(),
]
)
)
);
} else {
@@ -251,6 +258,7 @@ class departmentLanesRoute
// Remove spaces from the relay_in_id and relay_out_id
// Check if the required fields are set
if ($name && $department) {
self::requireDepartmentAccess((int)$department);
// Add the department lane
(new department_lanes_o())->add((int)$department, (string)$name, $relay_in_id, $relay_out_id, $relay_machine_id, $dynamic_image_id);
// Return a success message
@@ -301,11 +309,13 @@ class departmentLanesRoute
// Return an error
$response->error('Department lane not found', 404);
}
self::requireDepartmentAccess((int)$department_lane->department->value());
// Update the department lane fields that are set
if (self::isParametersSet(['name'])) {
$department_lane->name->set($name);
}
if (self::isParametersSet(['department'])) {
self::requireDepartmentAccess((int)$department);
$department_lane->department->set((int)$department);
}
if (self::isParametersSet(['relay_in_id'])) {
@@ -342,4 +352,4 @@ class departmentLanesRoute
]
);
}
}
}