aheathershaw/blue-twilight
1
0
Fork 0
Code Issues 32 Pull Requests Releases 15 Wiki Activity

#33: Fixed an issue where by the anonymous album check did not include the album ID, thereby allowing access if other albums allowed anonymous users.

Browse Source
This commit is contained in:
Andy Heathershaw 2017-09-10 11:18:12 +01:00
parent 818d4c39d2
commit 88d660d92e
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
app/Policies/AlbumPolicy.php
View File

@ -145,7 +145,10 @@ class AlbumPolicy
{ {
$query = Album::query()->join('album_anonymous_permissions', 'album_anonymous_permissions.album_id', '=', 'albums.id') $query = Album::query()->join('album_anonymous_permissions', 'album_anonymous_permissions.album_id', '=', 'albums.id')
->join('permissions', 'permissions.id', '=', 'album_anonymous_permissions.permission_id') ->join('permissions', 'permissions.id', '=', 'album_anonymous_permissions.permission_id')
->where('permissions.id', $permission->id); ->where([
['albums.id', $album->id],
['permissions.id', $permission->id]
]);
return $query->count() > 0; return $query->count() > 0;
} }