diff --git a/lib/Service/CardService.php b/lib/Service/CardService.php index dc74a2fb2..62a9b55ab 100644 --- a/lib/Service/CardService.php +++ b/lib/Service/CardService.php @@ -1,4 +1,4 @@ -lib/Service/CardService.php * @@ -264,7 +264,7 @@ public function delete($id) { public function update($id, $title, $stackId, $type, $owner, $description = '', $order = 0, $duedate = null, $deletedAt = null, $archived = null) { $this->cardServiceValidator->check(compact('id', 'title', 'stackId', 'type', 'owner', 'order')); - $this->permissionService->checkPermission($this->cardMapper, $id, Acl::PERMISSION_EDIT, allowDeletedCard: true); + $this->permissionService->checkPermission($this->cardMapper, $id, Acl::PERMISSION_EDIT, null, true); $this->permissionService->checkPermission($this->stackMapper, $stackId, Acl::PERMISSION_EDIT); if ($this->boardService->isArchived($this->cardMapper, $id)) { diff --git a/lib/Service/CommentService.php b/lib/Service/CommentService.php index d15c7cc88..5f47e0893 100644 --- a/lib/Service/CommentService.php +++ b/lib/Service/CommentService.php @@ -83,10 +83,6 @@ public function list(string $cardId, int $limit = 20, int $offset = 0): DataResp } /** - * @param string $cardId - * @param string $message - * @param string $replyTo - * @return DataResponse * @throws BadRequestException * @throws NotFoundException|NoPermissionException */ @@ -142,7 +138,7 @@ public function update(string $cardId, string $commentId, string $message): Data throw new NoPermissionException('Only authors are allowed to edit their comment.'); } if ($comment->getParentId() !== '0') { - $this->permissionService->checkPermission($this->cardMapper, $comment->getParentId(), Acl::PERMISSION_READ); + $this->permissionService->checkPermission($this->cardMapper, (int)$comment->getParentId(), Acl::PERMISSION_READ); } $comment->setMessage($message); diff --git a/lib/Service/PermissionService.php b/lib/Service/PermissionService.php index 48d6af96d..0a6a7432c 100644 --- a/lib/Service/PermissionService.php +++ b/lib/Service/PermissionService.php @@ -98,7 +98,11 @@ public function __construct( * @param $boardId * @return bool|array */ - public function getPermissions($boardId) { + public function getPermissions($boardId, ?string $userId = null) { + if ($userId === null) { + $userId = $this->userId; + } + if ($cached = $this->permissionCache->get($boardId)) { return $cached; } @@ -169,7 +173,7 @@ public function checkPermission($mapper, $id, $permission, $userId = null, bool } try { - $acls = $this->getBoard($boardId)->getAcl() ?? []; + $acls = $this->getBoard((int)$boardId)->getAcl() ?? []; $result = $this->userCan($acls, $permission, $userId); if ($result) { return true;