standardebooks/web
1
0
Fork 0
mirror of https://github.com/standardebooks/web.git synced 2025-07-07 15:20:32 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Set ReviewerUserId only if Status changed

Browse source 
For non-admin reviewers (i.e., without `CanReviewOwnArtwork`), the `PATCH` form
has a hidden element with the artwork's current `Status`. If the reviewer
updates the `EbookUrl` and not `Status`, then don't record the reviewer's
`ReviewerUserId` because they didn't review or change the `Status`.

Side note: Sending the `PATCH` form an invalid `Status` will result in a
validation error, but that validation error was hard to read because it was the
wrong exception type. This commit adds a new `InvalidArtworkStatusException` to
fix that.

Fixes #433
This commit is contained in:
Mike Colagrosso 2024-12-12 17:15:30 -07:00 • committed by Alex Cabal
parent 5e4636f249
commit cae8271ecb
3 changed files with 16 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

2
lib/Artwork.php
View file

@ -393,7 +393,7 @@ class Artwork{
}
if(!isset($this->Status)){
$error->Add(new Exceptions\InvalidArtworkException('Invalid status.'));
$error->Add(new Exceptions\InvalidArtworkStatusException());
}
if(isset($this->Tags)){

7
lib/Exceptions/InvalidArtworkStatusException.php Normal file
View file

@ -0,0 +1,7 @@
<?
namespace Exceptions;
class InvalidArtworkStatusException extends AppException{
/** @var string $message */
protected $message = 'Invalid artwork status.';
}

10
www/artworks/post.php
View file

@ -93,19 +93,19 @@ try{
// We can PATCH the status, the ebook www filesystem path, or both.
if(isset($_POST['artwork-status'])){
$newStatus = Enums\ArtworkStatusType::tryFrom(HttpInput::Str(POST, 'artwork-status') ?? '');
if($newStatus !== null){
if($artwork->Status != $newStatus && !$artwork->CanStatusBeChangedBy(Session::$User)){
if($artwork->Status != $newStatus){
if(!$artwork->CanStatusBeChangedBy(Session::$User)){
throw new Exceptions\InvalidPermissionsException();
}
if($newStatus !== null){
$artwork->ReviewerUserId = Session::$User->UserId;
$artwork->Status = $newStatus;
}
else{
}else{
unset($artwork->Status);
}
}
}
if(isset($_POST['artwork-ebook-url'])){
$newEbookUrl = HttpInput::Str(POST, 'artwork-ebook-url');