Cutlery/invoiceninja
1
0
Fork 0
mirror of https://github.com/invoiceninja/invoiceninja.git synced 2025-05-31 11:14:37 -04:00
Code Issues Packages Projects Releases Wiki Activity

Fixes for permissions

Browse Source
This commit is contained in:
David Bomba 2022-03-23 19:54:30 +11:00
parent f4f0290451
commit bf0cf1bbae
4 changed files with 8 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
app/Http/Controllers/Auth/LoginController.php
View File

@ -438,14 +438,6 @@ class LoginController extends BaseController
$cu = CompanyUser::query() $cu = CompanyUser::query()
->where('user_id', auth()->user()->id); ->where('user_id', auth()->user()->id);
// $cu->first()->account->companies->each(function ($company) use($cu){
// if($company->tokens()->where('is_system', true)->count() == 0)
// {
// CreateCompanyToken::dispatchNow($company, $cu->first()->user, request()->server('HTTP_USER_AGENT'));
// }
// });
if($existing_login_user->company_users()->count() != $existing_login_user->tokens()->count()) if($existing_login_user->company_users()->count() != $existing_login_user->tokens()->count())
{ {

2
app/Http/Controllers/BaseController.php
View File

@ -624,7 +624,7 @@ class BaseController extends Controller
// 10-01-2022 need to ensure we snake case properly here to ensure permissions work as expected // 10-01-2022 need to ensure we snake case properly here to ensure permissions work as expected
// if (auth()->user() && ! auth()->user()->hasPermission('view_'.lcfirst(class_basename($this->entity_type)))) { // if (auth()->user() && ! auth()->user()->hasPermission('view_'.lcfirst(class_basename($this->entity_type)))) {
if (auth()->user() && ! auth()->user()->hasPermission('view'.lcfirst(class_basename(Str::snake($this->entity_type))))) { if (auth()->user() && ! auth()->user()->hasPermission('view_'.lcfirst(class_basename(Str::snake($this->entity_type))))) {
$query->where('user_id', '=', auth()->user()->id); $query->where('user_id', '=', auth()->user()->id);
} }

12
app/Models/CompanyToken.php
View File

@ -59,13 +59,9 @@ class CompanyToken extends BaseModel
public function cu() public function cu()
{ {
return $this->hasOne(CompanyUser::class, 'user_id', 'user_id') return $this->hasOne(CompanyUser::class, 'user_id', 'user_id')
->where('company_id', $this->company_id) ->where('company_id', $this->company_id)
->where('user_id', $this->user_id); ->where('user_id', $this->user_id);
// return $this->company_user;
// return $this->belongsTo(CompanyUser::class)->where('user_id', $this->user_id);
// return $this->hasOneThrough(CompanyUser::class, Company::class, 'id', 'company_id', 'company_id', 'id');
} }
} }

9
app/Models/User.php
View File

@ -156,7 +156,6 @@ class User extends Authenticatable implements MustVerifyEmail
return CompanyToken::with(['cu'])->where('token', request()->header('X-API-TOKEN'))->first(); return CompanyToken::with(['cu'])->where('token', request()->header('X-API-TOKEN'))->first();
} }
return $this->tokens()->first(); return $this->tokens()->first();
} }
@ -371,9 +370,10 @@ class User extends Authenticatable implements MustVerifyEmail
return $this->isOwner() || return $this->isOwner() ||
$this->isAdmin() || $this->isAdmin() ||
(stripos($this->token()->cu->permissions, $all_permission) !== false) || (is_int(stripos($this->token()->cu->permissions, $all_permission))) ||
(stripos($this->token()->cu->permissions, $permission) !== false); (is_int(stripos($this->token()->cu->permissions, $permission)));
//23-03-2021 - stripos return an int if true and bool false, but 0 is also interpreted as false, so we simply use is_int() to verify state
// return $this->isOwner() || // return $this->isOwner() ||
// $this->isAdmin() || // $this->isAdmin() ||
// (stripos($this->company_user->permissions, $all_permission) !== false) || // (stripos($this->company_user->permissions, $all_permission) !== false) ||
@ -404,9 +404,6 @@ class User extends Authenticatable implements MustVerifyEmail
if($this->token()->cu->slack_webhook_url) if($this->token()->cu->slack_webhook_url)
return $this->token()->cu->slack_webhook_url; return $this->token()->cu->slack_webhook_url;
// if ($this->company_user->slack_webhook_url) {
// return $this->company_user->slack_webhook_url;
// }
} }
public function routeNotificationForMail($notification) public function routeNotificationForMail($notification)