Only allow workflows on owned boards, and show the board in the table
Build package / php-lint (8.4) (push) Successful in 1m7s
Build package / php-lint (8.5) (push) Successful in 56s
Build package / xml-lint (push) Successful in 17s
Build package / unit-tests (push) Successful in 42s
Build package / package (push) Successful in 1m4s

The board list now only contains boards the current user owns, which
also makes the controller's board validation enforce the owner rule.

The workflow table gains a Board column (Board, Titel, Von Stapel,
Nach Stapel, Filter, E-Mail, Aktiv) and is sorted alphabetically by
those columns in that order.
This commit is contained in:
Patrick Niebeling committed 2026-09-30 09:16:09 +02:00
1 parent 7c7c52cb1c
commit ada16cb101
4 files changed
+85 -22

No files matched your search

+7 -5
View File
@@ -85,14 +85,14 @@ class WorkflowController extends OCSController {
bool $notifyEmail = false,
bool $enabled = true,
): DataResponse {
$this->validate($title, $boardId, $sourceStackId, $targetStackId);
try {
$workflow = $this->workflowMapper->findForUser($id, $this->currentUserId());
} catch (DoesNotExistException $e) {
throw new OCSNotFoundException('Workflow not found');
}
$this->validate($title, $boardId, $sourceStackId, $targetStackId);
$this->applyFields($workflow, $title, $boardId, $sourceStackId, $targetStackId, $filterUserIds, $filterLabelIds, $notifyEmail, $enabled);
$workflow = $this->workflowMapper->update($workflow);
@@ -114,7 +114,7 @@ class WorkflowController extends OCSController {
#[NoAdminRequired]
public function boards(): DataResponse {
$this->assertDeck();
return new DataResponse($this->deckService->listBoardsForCurrentUser());
return new DataResponse($this->deckService->listBoardsForCurrentUser($this->currentUserId()));
}
#[NoAdminRequired]
@@ -161,12 +161,14 @@ class WorkflowController extends OCSController {
// not "Deck is unreachable".
$this->assertDeck();
// Only boards the user owns are listed, so this also enforces the
// owner rule.
$boardIds = array_map(
static fn (array $board) => (int)$board['id'],
$this->deckService->listBoardsForCurrentUser(),
$this->deckService->listBoardsForCurrentUser($this->currentUserId()),
);
if (!in_array($boardId, $boardIds, true)) {
throw new OCSBadRequestException('The selected board does not exist or is not accessible');
throw new OCSBadRequestException('The selected board does not exist or is not owned by you');
}
$stackIds = array_map(