diff --git a/src/Security/Voter/UploadVoter.php b/src/Security/Voter/UploadVoter.php index 4d2be2c..7653e29 100644 --- a/src/Security/Voter/UploadVoter.php +++ b/src/Security/Voter/UploadVoter.php @@ -35,7 +35,12 @@ class UploadVoter extends Voter // Administrative users have full access if (true === $this->security->isGranted('ROLE_ADMINISTRATIVE')) { - return true; + if (true === in_array($attribute, [static::VIEW, static::DELETE, static::DOWNLOAD])) { + return true; + } + + // Document status may only be updated for selected current status + return true === in_array($upload->getStatus(), [Upload::STATUS_NEW, Upload::STATUS_PENDING]); } // Teamers may only access their own documents @@ -48,4 +53,4 @@ class UploadVoter extends Voter return false; } -} \ No newline at end of file +}