diff --git a/app/Http/Controllers/Admin/AlbumController.php b/app/Http/Controllers/Admin/AlbumController.php index 5b3ec49..bf30e02 100644 --- a/app/Http/Controllers/Admin/AlbumController.php +++ b/app/Http/Controllers/Admin/AlbumController.php @@ -425,6 +425,11 @@ class AlbumController extends Controller App::abort(404); return null; } + else if (!Auth::user()->can('edit', $album)) + { + App::abort(403); + return null; + } return $album; } diff --git a/app/Http/Middleware/GlobalConfiguration.php b/app/Http/Middleware/GlobalConfiguration.php index b8824e5..ea13584 100644 --- a/app/Http/Middleware/GlobalConfiguration.php +++ b/app/Http/Middleware/GlobalConfiguration.php @@ -44,7 +44,6 @@ class GlobalConfiguration // When running migrations, CLI tasks or the installer, don't need to add things to the view if (php_sapi_name() != 'cli') { - $this->addLicenseInfoToView(); $this->addThemeInfoToView(); $this->addAlbumsToView(); } @@ -61,21 +60,6 @@ class GlobalConfiguration View::share('albums', $albums); } - private function addLicenseInfoToView() - { - $licenseName = null; - $licenseNo = null; - - if (function_exists('sg_get_const')) - { - $licenseName = sg_get_const('lic_name'); - $licenseNo = sg_get_const('lic_num'); - } - - View::share('license_name', strlen($licenseName) == 0 ? '**UNLICENSED**' : $licenseName); - View::share('license_no', strlen($licenseNo) == 0 ? '0' : $licenseNo); - } - private function addThemeInfoToView() { $themeInfo = Theme::info(); diff --git a/app/Providers/AuthServiceProvider.php b/app/Providers/AuthServiceProvider.php index 8546b02..bd4d4fa 100644 --- a/app/Providers/AuthServiceProvider.php +++ b/app/Providers/AuthServiceProvider.php @@ -5,6 +5,7 @@ namespace App\Providers; use App\Album; use App\Facade\UserConfig; use App\Photo; +use App\Policies\AlbumPolicy; use Illuminate\Support\Facades\Gate; use Illuminate\Foundation\Support\Providers\AuthServiceProvider as ServiceProvider; @@ -16,7 +17,7 @@ class AuthServiceProvider extends ServiceProvider * @var array */ protected $policies = [ - 'App\Model' => 'App\Policies\ModelPolicy', + Album::class => AlbumPolicy::class ]; /** @@ -28,10 +29,6 @@ class AuthServiceProvider extends ServiceProvider { $this->registerPolicies(); - Gate::define('album.view', function ($user, Album $album) - { - return (!$album->is_private || $album->user_id == $user->id); - }); Gate::define('admin-access', function ($user) { return $user->is_admin; diff --git a/database/seeds/PermissionsSeeder.php b/database/seeds/PermissionsSeeder.php index a9a6aaf..476398b 100644 --- a/database/seeds/PermissionsSeeder.php +++ b/database/seeds/PermissionsSeeder.php @@ -11,10 +11,10 @@ class PermissionsSeeder extends Seeder */ public function run() { - // album:list-gallery = controls if the album is visible in the gallery + // album:list = controls if the album is visible in listings DatabaseSeeder::createOrUpdate('permissions', [ 'section' => 'album', - 'description' => 'list-gallery', + 'description' => 'list', 'is_default' => true, 'sort_order' => 0 ]); diff --git a/resources/lang/en/permissions.php b/resources/lang/en/permissions.php index eadf701..9c221b2 100644 --- a/resources/lang/en/permissions.php +++ b/resources/lang/en/permissions.php @@ -1,7 +1,8 @@ [ - 'list-gallery' => 'See this album in the gallery index', - 'view' => 'Access this gallery' + 'edit' => 'Manage this album', + 'list' => 'See this album in listings', + 'view' => 'Access this album' ] ]; \ No newline at end of file diff --git a/resources/views/themes/base/admin/list_albums.blade.php b/resources/views/themes/base/admin/list_albums.blade.php index cae0fd1..a30e597 100644 --- a/resources/views/themes/base/admin/list_albums.blade.php +++ b/resources/views/themes/base/admin/list_albums.blade.php @@ -36,13 +36,22 @@ @foreach ($albums as $album) - {{ $album->name }}@if ($album->is_private) @endif
+ + @can('edit', $album) + {{ $album->name }} + @endcan + @cannot('edit', $album) + {{ $album->name }} + @endcannot +

{{ $album->description }}

{{ $album->photos_count }} {{ trans_choice('admin.stats_widget.photos', $album->photos_count) }}

- @lang('forms.edit_action') - @lang('forms.delete_action') + @can('edit', $album) + @lang('forms.edit_action') + @lang('forms.delete_action') + @endcan @endforeach