security fix and fix parent pages

app/Services/Settings/SchoolCalendar/SchoolCalendarMutationService.php

@@ -36,7 +36,7 @@ class SchoolCalendarMutationService
 
     public function update(CalendarEvent $event, array $payload, array $targets = []): array
     {
-        $data = $this->normalizePayload($payload);
+        $data = $this->normalizePayload($payload, true);
 
         try {
             DB::transaction(function () use ($event, $data) {
@@ -69,8 +69,41 @@ class SchoolCalendarMutationService
         }
     }
 
-    private function normalizePayload(array $payload): array
+    private function normalizePayload(array $payload, bool $partial = false): array
     {
+        if ($partial) {
+            $data = [];
+            foreach ([
+                'title',
+                'description',
+                'event_type',
+                'date',
+                'notify_parent',
+                'notify_teacher',
+                'notify_admin',
+                'no_school',
+                'school_year',
+                'semester',
+            ] as $key) {
+                if (! array_key_exists($key, $payload)) {
+                    continue;
+                }
+
+                if (in_array($key, ['notify_parent', 'notify_teacher', 'notify_admin', 'no_school'], true)) {
+                    $data[$key] = ! empty($payload[$key]) ? 1 : 0;
+                    continue;
+                }
+
+                $data[$key] = $payload[$key];
+            }
+
+            if (! CalendarEvent::supportsEventType()) {
+                unset($data['event_type']);
+            }
+
+            return $data;
+        }
+
         $data = [
             'title' => (string) ($payload['title'] ?? ''),
             'description' => $payload['description'] ?? null,