Merge branch '1.0'

uvdesk · Jul 14, 2021 · 198077e · 198077e
2 parents 01f6b88 + b7303e8
commit 198077e
Showing 1 changed file with 18 additions and 2 deletions.
diff --git a/Controller/Thread.php b/Controller/Thread.php
@@ -200,16 +200,23 @@ public function updateThreadXHR(Request $request)
         $json = [];
         $em = $this->getDoctrine()->getManager();
         $content = json_decode($request->getContent(), true);
+        $thread = $em->getRepository(TicketThread::class)->find($request->attributes->get('threadId'));
+        $ticket = $thread->getTicket();
+        $user = $this->userService->getSessionUser();
+
+        // Proceed only if user has access to the resource
+        if ( (!$this->userService->getSessionUser()) || (false == $this->ticketService->isTicketAccessGranted($ticket, $user)) ) 
+        {
+            throw new \Exception('Access Denied', 403);
+        }
 
         if ($request->getMethod() == "PUT") {
             // $this->isAuthorized('ROLE_AGENT_EDIT_THREAD_NOTE');
             if (str_replace(' ','',str_replace('&nbsp;','',trim(strip_tags($content['reply'], '<img>')))) != "") {
-                $thread = $em->getRepository(TicketThread::class)->find($request->attributes->get('threadId'));
                 $thread->setMessage($content['reply']);
                 $em->persist($thread);
                 $em->flush();
 
-                $ticket = $thread->getTicket();
                 $ticket->currentThread = $thread;
 
                 // Trigger agent reply event
@@ -236,6 +243,15 @@ public function threadXHR(Request $request)
         $content = json_decode($request->getContent(), true);
         $em = $this->getDoctrine()->getManager();
 
+        $ticket = $entityManager->getRepository('UVDeskCoreFrameworkBundle:Ticket')->findOneById($content['ticketId']);	    
+        $user = $this->userService->getSessionUser();   
+
+        // Proceed only if user has access to the resource
+        if ( (!$this->userService->getSessionUser()) || (false == $this->ticketService->isTicketAccessGranted($ticket, $user)) ) 
+        {
+            throw new \Exception('Access Denied', 403);
+        }
+
         if ($request->getMethod() == "DELETE") {
             $thread = $em->getRepository(TicketThread::class)->findOneBy(array('id' => $request->attributes->get('threadId'), 'ticket' => $content['ticketId']));