ONE PIECE HACKING

Ngiler SH3LL 360
: / home / tbf / membrubackend / app / Http / Controllers / Api /

Information Server
MySQL : OFF Perl : OFF CURL : ON WGET : OFF PKEXEC : OFF

Directive	Local Value
IP Address	89.40.16.97
System	Linux server.atelieruldeit.ro 3.10.0-1160.el7.x86_64 #1 SMP Mon Oct 19 16:18:59 UTC 2020 x86_64
User	tbf
PHP Version	7.3.33
Software	Apache
Doc root	Writable

Edit File : ObjectiveController.php \| Size : 9.78 KB
<?php namespace App\Http\Controllers\Api; use App\Http\Controllers\Controller; use App\Models\Objective; use App\Models\Instance; use App\Models\NotificationLog; use App\Models\User; use App\Http\Resources\ObjectiveCollection; use App\Http\Resources\ObjectiveExtendedResource; use App\Http\Resources\EditObjectiveResource; use App\Http\Requests\ObjectiveFormRequest; use Illuminate\Http\Request; use Auth; class ObjectiveController extends Controller { public function index(Instance $instance, Request $request) { $authUser = Auth::user(); // check if the auth user can see private objectives if($authUser->isAdmin()){ $objectives = $instance->objectives; }else{ $objectives = $instance->objectives->whereNotIn('id', explode(',', $authUser->private_objective_ids)); } // filter after status if($request->status == Objective::STATUS_ACTIVE){ $objectives = $objectives->whereIn('status', [Objective::STATUS_ACTIVE, Objective::STATUS_OVERDUE]); }elseif($request->status){ $objectives = $objectives->where('status', $request->status); } return new ObjectiveCollection( $objectives->sortByDesc('created_at')->values() ); } public function store(ObjectiveFormRequest $request) { $data = $request->validated(); $authUser = Auth::user(); $objective = Objective::create($data); // set objective_private_ids for all users except the responsible one and the manager if($objective->is_private){ $authUser->instance->users->where('id', '!=', $data['user_id'])->each(function ($user) use ($objective) { if(!checkManagerAccess($objective->master_goal_id, $user)){ setPrivateObjectiveId($user, $objective->id); } }); } if($objective->user_id != $authUser->id){ assignedToObjectiveMail($objective->user, $objective); } NotificationLog::create([ 'username' => $authUser->getFullName(), 'entity_name' => $objective->name, 'avatar' => $objective->user->avatar, 'objective_slug' => $objective->slug, 'type' => NotificationLog::OBJECTIVE_RESPONSIBLE, 'frontend_type' => NotificationLog::FE_OBJECTIVES, 'responsible_id' => $objective->user_id, 'need_link' => 1, 'for_all' => $objective->is_private ? 0 : 1, 'for_auth_user' => $objective->user_id != $authUser->id ? 1 : 0, ]); // must be removed after we find the missing scenario updateUserPrivateObjectiveIds($objective->instance); return response()->json([ 'status' => 'success', ], 200); } public function show(Objective $objective) { $authUser = Auth::user(); if(!$authUser->isAdmin() && isPrivateObjective($objective->id, $authUser)){ return response()->json(['data' => []]); } return new ObjectiveExtendedResource( $objective ); } public function edit(Objective $objective) { return new EditObjectiveResource( $objective ); } public function update(ObjectiveFormRequest $request, Objective $objective) { $data = $request->validated(); $authUser = Auth::user(); $objectiveId = $objective->id; $userChanged = $data['user_id'] != $objective->user_id; $isPrivateChanged = $data['is_private'] != $objective->is_private; $data['status'] = setStatus($objective); // update users objective_private_ids if the objective change it`s private value if($isPrivateChanged && !$data['is_private']){ $authUser->instance->users->each(function ($user) use ($objectiveId) { removePrivateObjectiveId($user, $objectiveId); }); }elseif($isPrivateChanged && $data['is_private']){ $authUser->instance->users->where('id', '!=', $data['user_id'])->each(function ($user) use ($objective) { $objectiveId = $objective->id; if(!isPrivateObjective($objectiveId, $user) && !checkManagerAccess($objective->master_goal_id, $user)){ setPrivateObjectiveId($user, $objectiveId); } }); } // update users objective_private_ids if the objective is private and the user changed if($data['is_private'] && $userChanged){ // for old responsible user add this objective id to it`s objective_private_ids $oldRespUser = $objective->user; if($oldRespUser){ if(!isPrivateObjective($objectiveId, $oldRespUser) && !checkManagerAccess($objective->master_goal_id, $oldRespUser)){ setPrivateObjectiveId($oldRespUser, $objectiveId); } } // for new responsible user remove this objective id from it`s objective_private_ids $newRespUser = User::findOrFail($data['user_id']); removePrivateObjectiveId($newRespUser, $objectiveId); } $objective->update($data); $modifiedColumns = modifiedColumns($objective); if($modifiedColumns){ NotificationLog::create([ 'username' => $authUser->getFullName(), 'entity_name' => $objective->name, 'avatar' => $objective->user->avatar, 'objective_slug' => $objective->slug, 'type' => NotificationLog::OBJECTIVE_MODIFIED, 'frontend_type' => NotificationLog::FE_OBJECTIVES, 'responsible_id' => $objective->user_id, 'need_link' => 1, 'modified_columns' => $modifiedColumns, 'for_all' => $objective->is_private ? 0 : 1, 'for_auth_user' => $objective->user_id != $authUser->id ? 1 : 0, ]); } if($userChanged){ if($objective->user_id != $authUser->id){ assignedToObjectiveMail($objective->user, $objective); } NotificationLog::create([ 'username' => $authUser->getFullName(), 'entity_name' => $objective->name, 'avatar' => $objective->user->avatar, 'objective_slug' => $objective->slug, 'type' => NotificationLog::OBJECTIVE_NEW_RESPONSIBLE, 'frontend_type' => NotificationLog::FE_OBJECTIVES, 'responsible_id' => $objective->user_id, 'need_link' => 1, 'for_all' => $objective->is_private ? 0 : 1, 'for_auth_user' => $objective->user_id != $authUser->id ? 1 : 0, ]); } // must be removed after we find the missing scenario updateUserPrivateObjectiveIds($objective->instance); return response()->json([ 'status' => 'success' ], 200); } public function destroy(Objective $objective) { $instance = $objective->instance; // delete users objective_private_ids if($objective->is_private){ Auth::user()->instance->users->each(function ($user) use ($objective) { removePrivateObjectiveId($user, $objective->id); }); } $respUser = $objective->user; if($respUser){ NotificationLog::create([ 'username' => Auth::user()->getFullName(), 'entity_name' => $objective->name, 'avatar' => $objective->user->avatar, 'objective_slug' => $objective->slug, 'type' => NotificationLog::OBJECTIVE_DELETED, 'frontend_type' => NotificationLog::FE_OBJECTIVES, 'responsible_id' => $objective->user_id, 'for_all' => $objective->is_private ? 0 : 1, 'for_auth_user' => $objective->user_id != Auth::user()->id ? 1 : 0, ]); } $objective->delete(); // must be removed after we find the missing scenario updateUserPrivateObjectiveIds($instance); return response()->json([ 'status' => 'success' ], 200); } public function statusList() { return response()->json([ 'status' => 'success', 'data' => Objective::getStatusList(), ], 200); } public function showAll(Request $request) { $authUser = Auth::user(); $objectives = Objective::where('instance_id', $authUser->instance_id)->get()->map(function ($objective) use ($request, $authUser){ if($authUser->isAdmin()){ return [ 'id' => $objective->id, 'name' => $objective->name, 'available' => ($request->start_date >= $objective->start_date && ($request->end_date <= $objective->end_date)) ? true : false, 'start_date' => $objective->start_date, 'end_date' => $objective->end_date ]; }else{ if(!isPrivateObjective($objective->id, $authUser)){ return [ 'id' => $objective->id, 'name' => $objective->name, 'available' => ($request->start_date >= $objective->start_date && ($request->end_date <= $objective->end_date)) ? true : false, 'start_date' => $objective->start_date, 'end_date' => $objective->end_date ]; } } })->filter()->values(); return response()->json([ 'status' => 'success', 'data' => $objectives ], 200); } } Back

Edit File : ObjectiveController.php | Size : 9.78 KB

<?php

namespace App\Http\Controllers\Api;

use App\Http\Controllers\Controller;
use App\Models\Objective;
use App\Models\Instance;
use App\Models\NotificationLog;
use App\Models\User;
use App\Http\Resources\ObjectiveCollection;
use App\Http\Resources\ObjectiveExtendedResource;
use App\Http\Resources\EditObjectiveResource;
use App\Http\Requests\ObjectiveFormRequest;
use Illuminate\Http\Request;
use Auth;

class ObjectiveController extends Controller
{
    public function index(Instance $instance, Request $request) {
        $authUser = Auth::user();

// check if the auth user can see private objectives
        if($authUser->isAdmin()){
            $objectives = $instance->objectives;
        }else{
            $objectives = $instance->objectives->whereNotIn('id', explode(',', $authUser->private_objective_ids));
        }

// filter after status
        if($request->status == Objective::STATUS_ACTIVE){
            $objectives = $objectives->whereIn('status', [Objective::STATUS_ACTIVE, Objective::STATUS_OVERDUE]);
        }elseif($request->status){
            $objectives = $objectives->where('status', $request->status);
        }

return new ObjectiveCollection(
            $objectives->sortByDesc('created_at')->values()
        );
    }

public function store(ObjectiveFormRequest $request) {
        $data = $request->validated();
        $authUser = Auth::user();

$objective = Objective::create($data);

// set objective_private_ids for all users except the responsible one and the manager
        if($objective->is_private){
            $authUser->instance->users->where('id', '!=', $data['user_id'])->each(function ($user) use ($objective) {
                if(!checkManagerAccess($objective->master_goal_id, $user)){
                    setPrivateObjectiveId($user, $objective->id);
                }
            });
        }

if($objective->user_id != $authUser->id){
            assignedToObjectiveMail($objective->user, $objective);
        }

NotificationLog::create([
            'username' => $authUser->getFullName(),
            'entity_name' => $objective->name,
            'avatar' => $objective->user->avatar,
            'objective_slug' => $objective->slug,
            'type' => NotificationLog::OBJECTIVE_RESPONSIBLE,
            'frontend_type' => NotificationLog::FE_OBJECTIVES,
            'responsible_id' => $objective->user_id,
            'need_link' => 1,
            'for_all' => $objective->is_private ? 0 : 1,
            'for_auth_user' => $objective->user_id != $authUser->id ? 1 : 0,
        ]);

// must be removed after we find the missing scenario
        updateUserPrivateObjectiveIds($objective->instance);

return response()->json([
            'status'    => 'success',
        ], 200);
    }

public function show(Objective $objective) {
        $authUser = Auth::user();

if(!$authUser->isAdmin() && isPrivateObjective($objective->id, $authUser)){
            return response()->json(['data' => []]);
        }

return new ObjectiveExtendedResource(
            $objective
        );
    }

public function edit(Objective $objective) {
        return new EditObjectiveResource(
            $objective
        );
    }

public function update(ObjectiveFormRequest $request, Objective $objective) {
        $data = $request->validated();
        $authUser = Auth::user();
        $objectiveId = $objective->id;
        
        $userChanged = $data['user_id'] != $objective->user_id;
        $isPrivateChanged = $data['is_private'] != $objective->is_private;
        $data['status'] = setStatus($objective);

// update users objective_private_ids if the objective change it`s private value
        if($isPrivateChanged && !$data['is_private']){
            $authUser->instance->users->each(function ($user) use ($objectiveId) {
                removePrivateObjectiveId($user, $objectiveId);
            });
        }elseif($isPrivateChanged && $data['is_private']){
            $authUser->instance->users->where('id', '!=', $data['user_id'])->each(function ($user) use ($objective) {
                $objectiveId = $objective->id;
                if(!isPrivateObjective($objectiveId, $user) && !checkManagerAccess($objective->master_goal_id, $user)){
                    setPrivateObjectiveId($user, $objectiveId);
                }
            });
        }

// update users objective_private_ids if the objective is private and the user changed
        if($data['is_private'] && $userChanged){
            // for old responsible user add this objective id to it`s objective_private_ids
            $oldRespUser = $objective->user;
            if($oldRespUser){
                if(!isPrivateObjective($objectiveId, $oldRespUser) && !checkManagerAccess($objective->master_goal_id, $oldRespUser)){
                    setPrivateObjectiveId($oldRespUser, $objectiveId);
                }
            }
            // for new responsible user remove this objective id from it`s objective_private_ids
            $newRespUser = User::findOrFail($data['user_id']);
            removePrivateObjectiveId($newRespUser, $objectiveId);
        }

$objective->update($data);

$modifiedColumns = modifiedColumns($objective);
        if($modifiedColumns){
            NotificationLog::create([
                'username' => $authUser->getFullName(),
                'entity_name' => $objective->name,
                'avatar' => $objective->user->avatar,
                'objective_slug' => $objective->slug,
                'type' => NotificationLog::OBJECTIVE_MODIFIED,
                'frontend_type' => NotificationLog::FE_OBJECTIVES,
                'responsible_id' => $objective->user_id,
                'need_link' => 1,
                'modified_columns' => $modifiedColumns,
                'for_all' => $objective->is_private ? 0 : 1,
                'for_auth_user' => $objective->user_id != $authUser->id ? 1 : 0,
            ]);
        }

if($userChanged){
            if($objective->user_id != $authUser->id){
                assignedToObjectiveMail($objective->user, $objective);
            }

NotificationLog::create([
                'username' => $authUser->getFullName(),
                'entity_name' => $objective->name,
                'avatar' => $objective->user->avatar,
                'objective_slug' => $objective->slug,
                'type' => NotificationLog::OBJECTIVE_NEW_RESPONSIBLE,
                'frontend_type' => NotificationLog::FE_OBJECTIVES,
                'responsible_id' => $objective->user_id,
                'need_link' => 1,
                'for_all' => $objective->is_private ? 0 : 1,
                'for_auth_user' => $objective->user_id != $authUser->id ? 1 : 0,
            ]);
        }

// must be removed after we find the missing scenario
        updateUserPrivateObjectiveIds($objective->instance);

return response()->json([
            'status' => 'success'
        ], 200);
    }

public function destroy(Objective $objective) {
        $instance = $objective->instance;
        // delete users objective_private_ids
        if($objective->is_private){
            Auth::user()->instance->users->each(function ($user) use ($objective) {
                removePrivateObjectiveId($user, $objective->id);
            });
        }

$respUser = $objective->user;
        if($respUser){
            NotificationLog::create([
                'username' => Auth::user()->getFullName(),
                'entity_name' => $objective->name,
                'avatar' => $objective->user->avatar,
                'objective_slug' => $objective->slug,
                'type' => NotificationLog::OBJECTIVE_DELETED,
                'frontend_type' => NotificationLog::FE_OBJECTIVES,
                'responsible_id' => $objective->user_id,
                'for_all' => $objective->is_private ? 0 : 1,
                'for_auth_user' => $objective->user_id != Auth::user()->id ? 1 : 0,
            ]);
        }

$objective->delete();

// must be removed after we find the missing scenario
        updateUserPrivateObjectiveIds($instance);

return response()->json([
            'status' => 'success'
        ], 200);
    }

public function statusList() {
        return response()->json([
            'status'    => 'success',
            'data'      => Objective::getStatusList(),
        ], 200);
    }

public function showAll(Request $request) {
        $authUser = Auth::user();

$objectives = Objective::where('instance_id', $authUser->instance_id)->get()->map(function ($objective) use ($request, $authUser){
            if($authUser->isAdmin()){
                return [
                    'id'                => $objective->id,
                    'name'              => $objective->name,
                    'available'         => ($request->start_date >= $objective->start_date && ($request->end_date <= $objective->end_date)) ? true : false,
                    'start_date'        => $objective->start_date,
                    'end_date'          => $objective->end_date
                ];
            }else{
                if(!isPrivateObjective($objective->id, $authUser)){
                    return [
                        'id'                => $objective->id,
                        'name'              => $objective->name,
                        'available'         => ($request->start_date >= $objective->start_date && ($request->end_date <= $objective->end_date)) ? true : false,
                        'start_date'        => $objective->start_date,
                        'end_date'          => $objective->end_date
                    ];
                }
            }
        })->filter()->values();
        
        return response()->json([
            'status'    => 'success',
            'data'      => $objectives
        ], 200);
    }

}

Back