From a6cf4c28d960315060a0b2299b553538c0e747ba Mon Sep 17 00:00:00 2001 From: samin-z Date: Tue, 20 Oct 2026 14:05:01 +0200 Subject: [PATCH] respondent check Signed-off-by: samin-z [skip ci] --- lib/Controller/ApiController.php | 1 - tests/Unit/Controller/ApiControllerTest.php | 10 ++++++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/lib/Controller/ApiController.php b/lib/Controller/ApiController.php index 6d9a5d242..08b8448d3 100644 --- a/lib/Controller/ApiController.php +++ b/lib/Controller/ApiController.php @@ -1531,7 +1531,6 @@ public function updateSubmission(int $formId, int $submissionId, array $answers) throw new OCSBadRequestException($e->getMessage()); } - // get existing submission of this user try { $submission = $this->submissionMapper->findById($submissionId); } catch (DoesNotExistException) { diff --git a/tests/Unit/Controller/ApiControllerTest.php b/tests/Unit/Controller/ApiControllerTest.php index 4ef57fba9..deb8781f5 100644 --- a/tests/Unit/Controller/ApiControllerTest.php +++ b/tests/Unit/Controller/ApiControllerTest.php @@ -1651,6 +1651,11 @@ public function testUpdateSubmission_success() { ->with(1) ->willReturn($form); + $this->formsService->expects($this->once()) + ->method('getPermissions') + ->with($form) + ->willReturn([]); + $this->formsService->expects($this->once()) ->method('getQuestions') ->with($formId) @@ -1826,6 +1831,11 @@ public function testUpdateSubmission_notOwnSubmission() { ->with(1) ->willReturn($form); + $this->formsService->expects($this->once()) + ->method('getPermissions') + ->with($form) + ->willReturn([Constants::PERMISSION_RESULTS_DELETE]); + $this->formsService->expects($this->once()) ->method('getQuestions') ->with($formId)