Bulk action permission check fixed.

2020-02-13 15:49:43 +03:00
parent d9e9271858
commit 2000de7b7b
2 changed files with 82 additions and 68 deletions
--- a/app/Http/Controllers/Common/BulkActions.php
+++ b/app/Http/Controllers/Common/BulkActions.php
@ -29,6 +29,18 @@ BulkActions extends Controller
            $bulk_actions = app('App\BulkActions\\' .  ucfirst($group) . '\\' . ucfirst($type));
        }

+        if (isset($bulk_actions->actions[$request->get('handle')]['permission']) && !user()->can($bulk_actions->actions[$request->get('handle')]['permission'])) {
+            flash(trans('errors.message.403'))->error();
+
+            return response()->json([
+                'success' => false,
+                'redirect' => true,
+                'error' => true,
+                'data' => [],
+                'message' => trans('errors.message.403')
+            ]);
+        }
+
        $result = $bulk_actions->{$request->get('handle')}($request);

        if (!empty($result) && ($result instanceof \Symfony\Component\HttpFoundation\BinaryFileResponse)) {