From fe8f4d8c15386343be164551481a0fba6ab6d7bb Mon Sep 17 00:00:00 2001
From: Johannes Meyer <johannes.meyer@netways.de>
Date: Wed, 16 Jan 2019 13:38:30 +0100
Subject: [PATCH] js: Don't permit to create loops

---
 .../Businessprocess/Renderer/TreeRenderer.php   |  5 +++--
 public/js/module.js                             | 17 +++++++++++++----
 2 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/library/Businessprocess/Renderer/TreeRenderer.php b/library/Businessprocess/Renderer/TreeRenderer.php
index 7981bd5..f27cd10 100644
--- a/library/Businessprocess/Renderer/TreeRenderer.php
+++ b/library/Businessprocess/Renderer/TreeRenderer.php
@@ -111,10 +111,11 @@ class TreeRenderer extends Renderer
      */
     public function renderNode(BpConfig $bp, Node $node, $path = array())
     {
+        $htmlId = $this->getId($node, $path);
         $table = Html::tag(
             'li',
             [
-                'id'                => $this->getId($node, $path),
+                'id'                => $htmlId,
                 'class'             => ['bp', 'movable', $node->getObjectClassName()],
                 'data-node-name'    => $node->getName()
             ]
@@ -169,7 +170,7 @@ class TreeRenderer extends Renderer
             'data-sortable-draggable'       => '.movable',
             'data-sortable-direction'       => 'vertical',
             'data-sortable-group'           => json_encode([
-                'name'  => 'branch',
+                'name'  => $htmlId, // Unique, so that the function below is the only deciding factor
                 'put'   => 'function:rowPutAllowed'
             ]),
             'data-csrf-token'               => CsrfToken::generate(),
diff --git a/public/js/module.js b/public/js/module.js
index 88a6ec4..6010fb4 100644
--- a/public/js/module.js
+++ b/public/js/module.js
@@ -151,15 +151,24 @@
          * @param from
          * @param item
          * @param event
-         * @returns {*}
+         * @returns boolean
          */
         rowPutAllowed: function(to, from, item, event) {
-            if (from.options.group.name === 'root') {
-                return true;
-            }
             if (to.options.group.name === 'root') {
                 return $(item).is('.process');
             }
+
+            // Otherwise we're facing a nesting error next
+            var $item = $(item),
+                childrenNames = $item.find('.process').map(function () {
+                    return $(this).data('nodeName');
+                }).get();
+            childrenNames.push($item.data('nodeName'));
+            var loopDetected = $(to.el).parents('.process').toArray().some(function (parent) {
+                return childrenNames.indexOf($(parent).data('nodeName')) !== -1;
+            });
+
+            return !loopDetected;
         },
 
         /**