This commit moves most controller logic onto Services. Services are part of the Service-Repository pattern. The models act as repositories.
Services are easily testable and are needed for the upcoming API, in order to avoid duplicated code and to maintain a single source of "truth".
The User, Vacancy and Vote controllers still need their logic moved onto services.
This commit changes the deletion mechanism for forms. Currently, it sets the wanted deletion ID to the session, and redirects the user to the previous page, to open a confirmation dialog for deletion.
This commit fixes some superficial instances of Broken Access Control
(https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A5-Broken_Access_Control).
There may be some more instances of this, as authorization was only done
after most of the controllers were done (big mistake).
Some refactoring was also performed, where Route Model Binding with DI
(dependency injection) was used whenever possible, to increase
testability of the codebase.
Some reused code was also moved to Helper classes as to enforce DRY;
There may be some lines of code that are still copy-pasted from other
parts of the codebase for reuse.
Non-breaking refactoring changes were made, but the app as a whole still
needs full manual testing, and customised responses to HTTP 500
responses. Some errors are also not handled gracefully and this wasn't
checked in this commit.
This commit adds the ability to edit and modify existing forms.
On the technical side, it also adds a new reusable validation Facade which helps reduce duplicated code.
This commit also improves how forms are parsed by PHP by passing them as arrays, therefore making them easier to process.
Note: One of the files contains a debug statement that will be removed in the next commit
Miguel Nogueira
Miguel N