diff --git a/app/Http/Controllers/FileFunctions/EditItemsController.php b/app/Http/Controllers/FileFunctions/EditItemsController.php index 539024f2..ca3d2caf 100644 --- a/app/Http/Controllers/FileFunctions/EditItemsController.php +++ b/app/Http/Controllers/FileFunctions/EditItemsController.php @@ -241,13 +241,14 @@ class EditItemsController extends Controller } // Check shared permission - if (!is_editor($shared)) abort(403); + if (is_visitor($shared)) { + abort(403); + } - foreach ($request->input('data') as $file) { - $id = $file['id']; + foreach ($request->items as $file) { // Get file|folder item - $item = get_item($file['type'], $id, $shared->user_id); + $item = get_item($file['type'], $file['id']); // Check access to requested item if ($file['type'] === 'folder') { @@ -257,10 +258,10 @@ class EditItemsController extends Controller } // Delete item - Editor::delete_item($file, $id, $shared); + Editor::delete_item($file, $file['id'], $shared); } // Return response - return response(null, 204); + return response('Done', 204); } /** diff --git a/app/Http/Tools/Editor.php b/app/Http/Tools/Editor.php index 25c39a4d..f45a2c19 100644 --- a/app/Http/Tools/Editor.php +++ b/app/Http/Tools/Editor.php @@ -373,7 +373,7 @@ class Editor */ public static function move($request, $to_id) { - foreach ($request->input('items') as $item) { + foreach ($request->items as $item) { // Move folder if ($item['type'] === 'folder') { @@ -382,7 +382,6 @@ class Editor ->update([ 'parent_id' => $to_id ]); - } // Move file diff --git a/tests/Feature/Share/ShareEditorTest.php b/tests/Feature/Share/ShareEditorTest.php index ca5dcb71..a968ccc6 100644 --- a/tests/Feature/Share/ShareEditorTest.php +++ b/tests/Feature/Share/ShareEditorTest.php @@ -99,6 +99,52 @@ class ShareEditorTest extends TestCase ]); } + /** + * @test + */ + public function it_delete_multiple_files_in_shared_folder() + { + $folder = Folder::factory(Folder::class) + ->create(); + + $share = Share::factory(Share::class) + ->create([ + 'item_id' => $folder->id, + 'user_id' => $folder->user_id, + 'type' => 'folder', + 'is_protected' => false, + 'permission' => 'editor', + ]); + + $files = File::factory(File::class) + ->count(2) + ->create([ + 'folder_id' => $folder->id + ]); + + $this->postJson("/api/editor/remove/public/$share->token", [ + 'items' => [ + [ + 'id' => $files[0]->id, + 'type' => 'file', + 'force_delete' => false, + ], + [ + 'id' => $files[1]->id, + 'type' => 'file', + 'force_delete' => false, + ], + ], + ])->assertStatus(204); + + $files + ->each(function ($file) { + $this->assertSoftDeleted('files', [ + 'id' => $file->id, + ]); + }); + } + /** * @test */