Update SECURITY.md

[bookstack] / app / Users / Controllers / UserPreferencesController.php

diff --git a/app/Users/Controllers/UserPreferencesController.php b/app/Users/Controllers/UserPreferencesController.php
index 999115e7b126592b81cf915514693cf91a73983e..08d65743b8c766b1e76e7da08b55b07d5de59c18 100644 (file)
--- a/app/Users/Controllers/UserPreferencesController.php
+++ b/app/Users/Controllers/UserPreferencesController.php
@@ -2,7 +2,6 @@
 
 namespace BookStack\Users\Controllers;
 
-use BookStack\Activity\Models\Watch;
 use BookStack\Http\Controller;
 use BookStack\Permissions\PermissionApplicator;
 use BookStack\Settings\UserNotificationPreferences;
@@ -17,6 +16,14 @@ class UserPreferencesController extends Controller
     ) {
     }
 
+    /**
+     * Show the overview for user preferences.
+     */
+    public function index()
+    {
+        return view('users.preferences.index');
+    }
+
     /**
      * Show the user-specific interface shortcuts.
      */
@@ -25,6 +32,8 @@ class UserPreferencesController extends Controller
         $shortcuts = UserShortcutMap::fromUserPreferences();
         $enabled = setting()->getForCurrentUser('ui-shortcuts-enabled', false);
 
+        $this->setPageTitle(trans('preferences.shortcuts_interface'));
+
         return view('users.preferences.shortcuts', [
             'shortcuts' => $shortcuts,
             'enabled' => $enabled,
@@ -53,12 +62,17 @@ class UserPreferencesController extends Controller
      */
     public function showNotifications(PermissionApplicator $permissions)
     {
+        $this->checkPermission('receive-notifications');
+        $this->preventGuestAccess();
+
         $preferences = (new UserNotificationPreferences(user()));
 
-        $query = Watch::query()->where('user_id', '=', user()->id);
+        $query = user()->watches()->getQuery();
         $query = $permissions->restrictEntityRelationQuery($query, 'watches', 'watchable_id', 'watchable_type');
+        $query = $permissions->filterDeletedFromEntityRelationQuery($query, 'watches', 'watchable_id', 'watchable_type');
         $watches = $query->with('watchable')->paginate(20);
 
+        $this->setPageTitle(trans('preferences.notifications'));
         return view('users.preferences.notifications', [
             'preferences' => $preferences,
             'watches' => $watches,
@@ -70,6 +84,8 @@ class UserPreferencesController extends Controller
      */
     public function updateNotifications(Request $request)
     {
+        $this->checkPermission('receive-notifications');
+        $this->preventGuestAccess();
         $data = $this->validate($request, [
            'preferences' => ['required', 'array'],
            'preferences.*' => ['required', 'string'],
@@ -129,7 +145,7 @@ class UserPreferencesController extends Controller
      */
     public function toggleDarkMode()
     {
-        $enabled = setting()->getForCurrentUser('dark-mode-enabled', false);
+        $enabled = setting()->getForCurrentUser('dark-mode-enabled');
         setting()->putForCurrentUser('dark-mode-enabled', $enabled ? 'false' : 'true');
 
         return redirect()->back();