From ec11dea8a95acf75718fa0f7871facb98979ce72 Mon Sep 17 00:00:00 2001
From: Thomas Gelf <thomas@gelf.net>
Date: Thu, 15 Nov 2018 12:42:06 +0100
Subject: [PATCH] Basket: allow to download for non-primary Instance

---
 application/controllers/BasketController.php  |  6 ++++-
 .../Web/Controller/Extension/DirectorDb.php   | 25 ++++++++++++++++++-
 2 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/application/controllers/BasketController.php b/application/controllers/BasketController.php
index 14072705..f0a07261 100644
--- a/application/controllers/BasketController.php
+++ b/application/controllers/BasketController.php
@@ -171,7 +171,11 @@ class BasketController extends ActionController
             ),
             Link::create(
                 $this->translate('Download'),
-                $this->url()->with('action', 'download'),
+                $this->url()
+                    ->with([
+                        'action' => 'download',
+                        'dbResourceName' => $this->getDbResourceName()
+                    ]),
                 null,
                 [
                     'class'  => 'icon-download',
diff --git a/library/Director/Web/Controller/Extension/DirectorDb.php b/library/Director/Web/Controller/Extension/DirectorDb.php
index d733f2cc..4ab3acd4 100644
--- a/library/Director/Web/Controller/Extension/DirectorDb.php
+++ b/library/Director/Web/Controller/Extension/DirectorDb.php
@@ -13,13 +13,36 @@ trait DirectorDb
 
     protected function getDbResourceName()
     {
-        if ($name = $this->getPreferredDbResourceName()) {
+        if ($name = $this->getDbResourceNameFromRequest()) {
+            return $name;
+        } elseif ($name = $this->getPreferredDbResourceName()) {
             return $name;
         } else {
             return $this->getFirstDbResourceName();
         }
     }
 
+    protected function getDbResourceNameFromRequest()
+    {
+        $param = 'dbResourceName';
+        // We shouldn't access _POST and _GET. However, this trait is used
+        // in various places - and our Request is going to be replaced anyways.
+        // So, let's not over-engineer things, this is quick & dirty:
+        if (isset($_POST[$param])) {
+            $name = $_POST[$param];
+        } elseif (isset($_GET[$param])) {
+            $name = $_GET[$param];
+        } else {
+            return null;
+        }
+
+        if (in_array($name, $this->listAllowedDbResourceNames())) {
+            return $name;
+        } else {
+            return null;
+        }
+    }
+
     protected function getPreferredDbResourceName()
     {
         return $this->getWindowSessionValue('db_resource');