Kimirock/freescout
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Limit fields which can be updated on mailbox Settings and Auto Reply pages

Browse Source
This commit is contained in:
FreeScout
2025-05-20 02:40:12 -07:00
parent 1628567cfc
commit 119a2772ec
2 changed files with 41 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
app/Http/Controllers/MailboxesController.php
View File

@@ -106,6 +106,8 @@ class MailboxesController extends Controller
{
$mailbox = Mailbox::findOrFail($id);
$user = auth()->user();
// Redirect to the accessible page.
if (!$user->can('updateSettings', $mailbox) && !$user->can('updateEmailSignature', $mailbox)) {
$accessible_route = '';
@@ -160,11 +162,16 @@ class MailboxesController extends Controller
$mailbox = Mailbox::findOrFail($id);
$user = auth()->user();
$can_update_settings = $user->can('updateSettings', $mailbox);
$can_update_signature = $user->can('updateEmailSignature', $mailbox);
if (!$user->can('updateSettings', $mailbox) && !$user->can('updateEmailSignature', $mailbox)) {
if (!$can_update_settings && !$can_update_signature) {
\Helper::denyAccess();
}
$allowed_fields = [];
if ($user->can('updateSettings', $mailbox)) {
// Checkboxes
@@ -204,9 +211,22 @@ class MailboxesController extends Controller
->withErrors($validator)
->withInput();
}
$allowed_fields = [
'name',
'email',
'aliases',
'aliases_reply',
'auto_bcc',
'from_name',
'from_name_custom',
'ticket_status',
'ticket_assignee',
'before_reply',
];
}
if ($user->can('updateEmailSignature', $mailbox)) {
if ($can_update_signature) {
$validator = Validator::make($request->all(), [
'signature' => 'nullable|string',
]);
@@ -216,11 +236,21 @@ class MailboxesController extends Controller
->withErrors($validator)
->withInput();
}
$allowed_fields[] = 'signature';
}
\Eventy::action('mailbox.settings_before_save', $mailbox, $request);
$mailbox->fill($request->all());
// Leave only allowed fields.
$fields = $request->all();
foreach ($fields as $field_name => $value) {
if (!in_array($field_name, $allowed_fields)) {
unset($fields[$field_name]);
}
}
$mailbox->fill($fields);
$mailbox->signature = \Helper::stripDangerousTags($mailbox->signature);
$mailbox->save();
@@ -587,7 +617,13 @@ class MailboxesController extends Controller
}
}
$mailbox->fill($request->all());
$data = [
'auto_reply_enabled' => $request->auto_reply_enabled,
'auto_reply_subject' => $request->auto_reply_subject,
'auto_reply_message' => $request->auto_reply_message,
];
$mailbox->fill($data);
$mailbox->auto_reply_message = \Helper::stripDangerousTags($mailbox->auto_reply_message);
$mailbox->save();

2
app/Mailbox.php
View File

@@ -148,7 +148,7 @@ class Mailbox extends Model
*
* @var [type]
*/
protected $fillable = ['name', 'email', 'aliases', 'aliases_reply', 'auto_bcc', 'from_name', 'from_name_custom', 'ticket_status', 'ticket_assignee', 'template', 'before_reply', 'signature', 'out_method', 'out_server', 'out_username', 'out_password', 'out_port', 'out_encryption', 'in_server', 'in_port', 'in_username', 'in_password', 'in_protocol', 'in_encryption', 'in_validate_cert', 'auto_reply_enabled', 'auto_reply_subject', 'auto_reply_message', 'office_hours_enabled', 'ratings', 'ratings_placement', 'ratings_text', 'imap_sent_folder'];
protected $fillable = ['name', 'email', 'aliases', 'aliases_reply', 'auto_bcc', 'from_name', 'from_name_custom', 'ticket_status', 'ticket_assignee', 'before_reply', 'signature', 'out_method', 'out_server', 'out_username', 'out_password', 'out_port', 'out_encryption', 'in_server', 'in_port', 'in_username', 'in_password', 'in_protocol', 'in_encryption', 'in_validate_cert', 'auto_reply_enabled', 'auto_reply_subject', 'auto_reply_message', 'office_hours_enabled', 'ratings', 'ratings_placement', 'ratings_text', 'imap_sent_folder'];
protected static function boot()
{