diff --git a/app/Http/Requests/Company/ShowCompanyRequest.php b/app/Http/Requests/Company/ShowCompanyRequest.php index 1f14d823fd34..1eb1845e20d9 100644 --- a/app/Http/Requests/Company/ShowCompanyRequest.php +++ b/app/Http/Requests/Company/ShowCompanyRequest.php @@ -22,6 +22,9 @@ class ShowCompanyRequest extends Request */ public function authorize() : bool { - return auth()->user()->can('view', $this->company); + /** @var \App\Models\User $user */ + $user = auth()->user(); + + return $user->company()->id == $this->company->id; } } diff --git a/app/Listeners/Invoice/InvoicePaidActivity.php b/app/Listeners/Invoice/InvoicePaidActivity.php index 13cb70222beb..2d340dfb08df 100644 --- a/app/Listeners/Invoice/InvoicePaidActivity.php +++ b/app/Listeners/Invoice/InvoicePaidActivity.php @@ -47,6 +47,7 @@ class InvoicePaidActivity implements ShouldQueue $fields->user_id = $user_id; $fields->invoice_id = $event->invoice->id; + $fields->client_id = $event->invoice->client_id; $fields->company_id = $event->invoice->company_id; $fields->activity_type_id = Activity::PAID_INVOICE; $fields->payment_id = $event->payment->id; diff --git a/app/Policies/CompanyPolicy.php b/app/Policies/CompanyPolicy.php index 53a3406b3555..3249fe8bb8f7 100644 --- a/app/Policies/CompanyPolicy.php +++ b/app/Policies/CompanyPolicy.php @@ -43,7 +43,8 @@ class CompanyPolicy extends EntityPolicy return ($user->isAdmin() && $entity->id == $user->companyId()) || ($user->hasPermission('view_'.strtolower(class_basename($entity))) && $entity->id == $user->companyId()) // || ($user->hasPermission('view_all') && $entity->id == $user->companyId()) - || $user->owns($entity); + || $user->owns($entity) + || $user->companyId() == $entity->id; } /**