Merge pull request #8190 from nextcloud/update-setDoneStack

fix: validate board permission in setDoneStack method

Author: luka-nextcloud

lib/Service/StackService.php

@@ -306,6 +306,11 @@ public function reorder(int $id, int $order): array {
 	 */
 	public function setDoneStack(int $stackId, int $boardId, bool $isDone): void {
 		$this->permissionService->checkPermission($this->stackMapper, $stackId, Acl::PERMISSION_MANAGE);
+		$stack = $this->stackMapper->find($stackId);
+
+		if ($stack->getBoardId() !== $boardId) {
+			throw new BadRequestException('Stack does not belong to the specified board.');
+		}
 
 		if ($this->boardService->isArchived($this->stackMapper, $stackId)) {
 			throw new NoPermissionException('Operation not allowed. This board is archived.');

tests/unit/Service/StackServiceTest.php

@@ -276,6 +276,10 @@ private function createStack(int $id, int $order) {
 
 	public function testSetDoneStackSetsDoneColumn(): void {
 		$this->permissionService->expects($this->once())->method('checkPermission');
+		$this->stackMapper->expects($this->once())
+			->method('find')
+			->with(5)
+			->willReturn($this->createStack(5, 0));
 		$this->boardService->expects($this->once())->method('isArchived')->willReturn(false);
 		$this->stackMapper->expects($this->once())
 			->method('clearDoneColumnForBoard')
@@ -303,6 +307,10 @@ public function testSetDoneStackSetsDoneColumn(): void {
 	public function testSetDoneStackDoesNotMarkCardsWhenUnsetting(): void {
 		$this->permissionService->expects($this->once())->method('checkPermission');
 		$this->boardService->expects($this->once())->method('isArchived')->willReturn(false);
+		$this->stackMapper->expects($this->once())
+			->method('find')
+			->with(5)
+			->willReturn($this->createStack(5, 0));
 		$this->stackMapper->expects($this->never())->method('clearDoneColumnForBoard');
 		$this->cardMapper->expects($this->never())->method('findAll');
 		$this->cardMapper->expects($this->never())->method('update');
@@ -314,9 +322,24 @@ public function testSetDoneStackDoesNotMarkCardsWhenUnsetting(): void {
 
 	public function testSetDoneStackThrowsOnArchivedBoard(): void {
 		$this->permissionService->expects($this->once())->method('checkPermission');
+		$this->stackMapper->expects($this->once())
+			->method('find')
+			->with(5)
+			->willReturn($this->createStack(5, 0));
 		$this->boardService->expects($this->once())->method('isArchived')->willReturn(true);
 		$this->stackMapper->expects($this->never())->method('setIsDoneColumn');
 		$this->expectException(\OCA\Deck\NoPermissionException::class);
 		$this->stackService->setDoneStack(5, 1, true);
 	}
+
+	public function testSetDoneStackThrowsOnMismatchBoardId(): void {
+		$this->permissionService->expects($this->once())->method('checkPermission');
+		$this->stackMapper->expects($this->once())
+			->method('find')
+			->with(5)
+			->willReturn($this->createStack(5, 0));
+		$this->stackMapper->expects($this->never())->method('setIsDoneColumn');
+		$this->expectException(\OCA\Deck\BadRequestException::class);
+		$this->stackService->setDoneStack(5, 2, true);
+	}
 }