FEAT #13671 TIME 4:30 Installer fixes + areLocked route

rest/index.php

@@ -423,6 +423,7 @@ $app->get('/resourcesList/users/{userId}/groups/{groupId}/baskets/{basketId}/fil
 $app->put('/resourcesList/users/{userId}/groups/{groupId}/baskets/{basketId}/exports', \Resource\controllers\ExportController::class . ':updateExport');
 $app->post('/resourcesList/users/{userId}/groups/{groupId}/baskets/{basketId}/summarySheets', \Resource\controllers\SummarySheetController::class . ':createList');
 $app->put('/resourcesList/users/{userId}/groups/{groupId}/baskets/{basketId}/actions/{actionId}', \Resource\controllers\ResourceListController::class . ':setAction');
+$app->put('/resourcesList/users/{userId}/groups/{groupId}/baskets/{basketId}/locked', \Resource\controllers\ResourceListController::class . ':areLocked');
 $app->get('/resourcesList/exportTemplate', \Resource\controllers\ExportController::class . ':getExportTemplates');
 $app->put('/resourcesList/integrations', \Resource\controllers\ResController::class . ':setInIntegrations');
 

src/app/resource/controllers/ResourceListController.php

@@ -604,6 +604,66 @@ class ResourceListController
         return $response->withStatus(204);
     }
 
+    public function areLocked(Request $request, Response $response, array $args)
+    {
+        $body = $request->getParsedBody();
+        if (!Validator::arrayType()->notEmpty()->validate($body['resources'])) {
+            return $response->withStatus(400)->withJson(['errors' => 'Data resources is empty or not an array']);
+        }
+        $body['resources'] = array_slice($body['resources'], 0, 500);
+
+        $errors = ResourceListController::listControl(['groupId' => $args['groupId'], 'userId' => $args['userId'], 'basketId' => $args['basketId'], 'currentUserId' => $GLOBALS['id']]);
+        if (!empty($errors['errors'])) {
+            return $response->withStatus($errors['code'])->withJson(['errors' => $errors['errors']]);
+        }
+
+        $basket = BasketModel::getById(['id' => $args['basketId'], 'select' => ['basket_clause']]);
+        $user   = UserModel::getById(['id' => $args['userId'], 'select' => ['user_id']]);
+
+        $whereClause = PreparedClauseController::getPreparedClause(['clause' => $basket['basket_clause'], 'login' => $user['user_id']]);
+        $resources = ResModel::getOnView([
+            'select'    => ['res_id', 'locker_user_id', 'locker_time'],
+            'where'     => [$whereClause, 'res_view_letterbox.res_id in (?)'],
+            'data'      => [$body['resources']]
+        ]);
+
+        $resourcesInBasket = array_column($resources, 'res_id');
+        if (!empty(array_diff($body['resources'], $resourcesInBasket))) {
+            return $response->withStatus(403)->withJson(['errors' => 'Resources out of perimeter']);
+        }
+
+        $locked = 0;
+        $resourcesToLock = [];
+        $lockersId = [];
+        foreach ($resources as $resource) {
+            $lock = true;
+            if (empty($resource['locker_user_id'] || empty($resource['locker_time']))) {
+                $lock = false;
+            } elseif ($resource['locker_user_id'] == $GLOBALS['id']) {
+                $lock = false;
+            } elseif (strtotime($resource['locker_time']) < time()) {
+                $lock = false;
+            }
+
+            if (!$lock) {
+                $resourcesToLock[] = $resource['res_id'];
+            } else {
+                $lockersId[] = $resource['locker_user_id'];
+                ++$locked;
+            }
+        }
+
+        $lockers = [];
+        if (!empty($lockersId)) {
+            $lockersId = array_unique($lockersId);
+            foreach ($lockersId as $lockerId) {
+                $lockers[] = UserModel::getLabelledUserById(['id' => $lockerId]);
+            }
+        }
+
+        return $response->withJson(['countLockedResources' => $locked, 'lockers' => $lockers, 'resourcesToProcess' => $resourcesToLock]);
+    }
+
     public static function listControl(array $aArgs)
     {
         ValidatorModel::notEmpty($aArgs, ['groupId', 'userId', 'basketId', 'currentUserId']);

src/core/controllers/InstallerController.php

@@ -372,6 +372,8 @@ class InstallerController
             return $response->withStatus(403)->withJson(['errors' => 'Custom is already installed']);
         } elseif (!is_file("custom/{$body['customId']}/apps/maarch_entreprise/xml/config.json")) {
             return $response->withStatus(400)->withJson(['errors' => 'Custom does not exist']);
+        } elseif (strpbrk($body['path'], '"\'<>|*:?') !== false) {
+            return $response->withStatus(400)->withJson(['errors' => 'Body path is not valid']);
         }
 
         $body['path'] = rtrim($body['path'], '/');
@@ -438,10 +440,6 @@ class InstallerController
             return $response->withStatus(400)->withJson(['errors' => 'Body bodyLoginBackground is empty']);
         } elseif (!Validator::stringType()->notEmpty()->validate($body['logo'])) {
             return $response->withStatus(400)->withJson(['errors' => 'Body logo is empty']);
-        } elseif (!Validator::stringType()->notEmpty()->validate($body['loginMessage'])) {
-            return $response->withStatus(400)->withJson(['errors' => 'Body loginMessage is empty or not a string']);
-        } elseif (!Validator::stringType()->notEmpty()->validate($body['homeMessage'])) {
-            return $response->withStatus(400)->withJson(['errors' => 'Body homeMessage is empty or not a string']);
         } elseif (!Validator::stringType()->notEmpty()->validate($body['customId'])) {
             return $response->withStatus(400)->withJson(['errors' => 'Body customId is empty or not a string']);
         } elseif (!preg_match('/^[a-zA-Z0-9_\-]*$/', $body['customId'])) {
@@ -489,13 +487,13 @@ class InstallerController
         new DatabasePDO(['customId' => $body['customId']]);
         DatabaseModel::update([
             'table'     => 'parameters',
-            'set'       => ['param_value_string' => $body['loginMessage']],
+            'set'       => ['param_value_string' => $body['loginMessage'] ?? ''],
             'where'     => ['id = ?'],
             'data'      => ['loginpage_message']
         ]);
         DatabaseModel::update([
             'table'     => 'parameters',
-            'set'       => ['param_value_string' => $body['homeMessage']],
+            'set'       => ['param_value_string' => $body['homeMessage'] ?? ''],
             'where'     => ['id = ?'],
             'data'      => ['homepage_message']
         ]);