diff --git a/app/Http/Controllers/Customers/Invoices.php b/app/Http/Controllers/Customers/Invoices.php index aff6c3b32..a53fb0041 100644 --- a/app/Http/Controllers/Customers/Invoices.php +++ b/app/Http/Controllers/Customers/Invoices.php @@ -184,7 +184,9 @@ class Invoices extends Controller public function link(Invoice $invoice, Request $request) { - session(['company_id' => $invoice->company_id]); + if (empty($invoice)) { + redirect()->route('login'); + } $paid = 0; diff --git a/app/Http/Kernel.php b/app/Http/Kernel.php index 8f21fcc23..596f625a2 100644 --- a/app/Http/Kernel.php +++ b/app/Http/Kernel.php @@ -73,6 +73,11 @@ class Kernel extends HttpKernel 'company.settings', 'company.currencies', ], + + 'signed' => [ + 'signed-url', + 'signed-url.company', + ] ]; /** @@ -100,5 +105,6 @@ class Kernel extends HttpKernel 'company.currencies' => \App\Http\Middleware\LoadCurrencies::class, 'dateformat' => \App\Http\Middleware\DateFormat::class, 'money' => \App\Http\Middleware\Money::class, + 'signed-url.company' => \App\Http\Middleware\SignedUrlCompany::class, ]; } diff --git a/app/Http/Middleware/SignedUrlCompany.php b/app/Http/Middleware/SignedUrlCompany.php new file mode 100644 index 000000000..88dee5246 --- /dev/null +++ b/app/Http/Middleware/SignedUrlCompany.php @@ -0,0 +1,33 @@ +get('company_id'); + + if (empty($company_id)) { + return $next($request); + } + + // Set company id + session(['company_id' => $company_id]); + + // Set the company settings + setting()->setExtraColumns(['company_id' => $company_id]); + setting()->load(true); + + return $next($request); + } +} diff --git a/app/Overrides/Akaunting/SignedUrl.php b/app/Overrides/Akaunting/SignedUrl.php new file mode 100644 index 000000000..65464c747 --- /dev/null +++ b/app/Overrides/Akaunting/SignedUrl.php @@ -0,0 +1,54 @@ +signatureKey = config('signed-url.signatureKey'); + $this->expiresParameter = config('signed-url.parameters.expires'); + $this->signatureParameter = config('signed-url.parameters.signature'); + } + + /** + * Get a secure URL to a controller action. + * + * @param string $url + * @param \DateTime|int|null $expiration Defaults to the config value + * + * @return string + */ + public function sign($url, $expiration = null) + { + $url .= '?company_id=' . session('company_id'); + + $expiration = $expiration ? $expiration : config('signed-url.default_expiration_time_in_days'); + + return parent::sign($url, $expiration); + } +} diff --git a/routes/web.php b/routes/web.php index eb2910458..737cbc61c 100644 --- a/routes/web.php +++ b/routes/web.php @@ -237,7 +237,7 @@ Route::group(['middleware' => 'language'], function () { }); }); - Route::group(['middleware' => 'signed-url'], function () { + Route::group(['middleware' => 'signed'], function () { Route::group(['prefix' => 'links'], function () { Route::get('invoices/{invoice}', 'Customers\Invoices@link'); Route::get('invoices/{invoice}/print', 'Customers\Invoices@printInvoice');