Added a check for accessibility permission to the project.

2024-05-18 20:18:41 +05:00
parent b6e1c50486
commit 78e6a1e396
1 changed files with 7 additions and 0 deletions
--- a/app/application/app/Http/Middleware/IsProject.php
+++ b/app/application/app/Http/Middleware/IsProject.php
@@ -20,6 +20,13 @@ final class IsProject
            \abort(Response::HTTP_NOT_FOUND);
        }

+        if (
+            $project->is_public === false
+            && ( $request->user() === null || $request->user()->cannot('view', $project) )
+        ) {
+            \abort(Response::HTTP_FORBIDDEN);
+        }
+
        return $next($request);
    }
 }