diff --git a/application/Preorderlogistics/PreorderlogisticsController.php b/application/Preorderlogistics/PreorderlogisticsController.php index 978e2a161..3254f53e1 100644 --- a/application/Preorderlogistics/PreorderlogisticsController.php +++ b/application/Preorderlogistics/PreorderlogisticsController.php @@ -186,8 +186,15 @@ class PreorderlogisticsController extends mfBaseController { if (empty($filter['preordercampaign_id'])) { $filter['preordercampaign_id'] = $my_campaign_ids; - } elseif (!in_array($filter['preordercampaign_id'], $my_campaign_ids)) { - return []; + } else { + // Ensure the filtered campaign is one the user has access to are arrays and if not allowed dont push it to the filter + $preordercampaign_ids = is_array($filter['preordercampaign_id']) ? $filter['preordercampaign_id'] : [$filter['preordercampaign_id']]; + + $new_allowed_ids = array_intersect($preordercampaign_ids, $my_campaign_ids); + if (empty($new_allowed_ids)) { + self::returnJson(['rows' => [], 'pagination' => ['total_rows' => 0]]); + return; + } } // Return objects for methods that expect them