diff --git a/app/Http/Controllers/InvoiceController.php b/app/Http/Controllers/InvoiceController.php
index 5999eaeb..acd4e542 100644
--- a/app/Http/Controllers/InvoiceController.php
+++ b/app/Http/Controllers/InvoiceController.php
@@ -22,9 +22,19 @@ use PDF;
 
 class InvoiceController extends Controller
 {
-    public function show($id)
+    public function show(Request $request, $id)
     {
         // validate $id is number
+        if (!is_numeric($id)) {
+            return response()->json(["message" => "Invalid id. Id needs to be a number"], 400);
+        }
+
+        // only allow if belongs or is admin
+        if ($request->user()->role === 'member') {
+            if (!$this->isUser($id, $request->user()->id)) {
+                return response()->json(['message' => 'The Invoice Does not belongs to you.'], 403);
+            }
+        }
 
         $invoice = Invoice::where('booking_id', $id)->first();
         if (!$invoice) {
@@ -45,6 +55,9 @@ class InvoiceController extends Controller
         $user = $request->user();
 
         // validate $id
+        if (!is_numeric($id)) {
+            return response()->json(["message" => "Invalid id. Id needs to be a number"], 400);
+        }
 
         $validatedData = $request->validate([
             'address' => 'required',
@@ -70,7 +83,7 @@ class InvoiceController extends Controller
         // user_id in booking does not match
         if ($booking->user_id !== $user->id) {
             return response()->json([
-                'message' => 'Booking does not belongs to you'
+                'message' => 'Booking does not belongs to you.'
             ], 403);
         }
 
@@ -140,7 +153,7 @@ class InvoiceController extends Controller
         $status->save();
 
         if($invoice_details) {
-            return $this->show($id);
+            return $this->show($request, $id);
         } else {
             return response(500);
         }
@@ -151,6 +164,9 @@ class InvoiceController extends Controller
         $user = $request->user();
 
         // validate $id
+        if (!is_numeric($id)) {
+            return response()->json(["message" => "Invalid id. Id needs to be a number"], 400);
+        }
 
         $validatedData = $request->validate([
             'address' => 'required',
@@ -256,7 +272,7 @@ class InvoiceController extends Controller
         $status->save();
 
         if($invoice_details) {
-            return $this->show($id);
+            return $this->show($request, $id);
         } else {
             return response(500);
         }
@@ -266,6 +282,9 @@ class InvoiceController extends Controller
     {
 
         // validate $id is integer
+        if (!is_numeric($id)) {
+            return response()->json(["message" => "Invalid id. Id needs to be a number"], 400);
+        }
 
         $validatedData = $request->validate([
             'status' => ['required', Rule::in('request_change', 'approve')],
@@ -314,6 +333,10 @@ class InvoiceController extends Controller
 
     public function customerToCIEFPO(Request $request, $id)
     {
+        if (!is_numeric($id)) {
+            return response()->json(["message" => "Invalid id. Id needs to be a number"], 400);
+        }
+
         // Booking Exist and Belongs to User or is Admin
         if ($request->user()->role === 'member') {
             if (!$this->isUser($id, $request->user()->id)) {
@@ -394,6 +417,11 @@ class InvoiceController extends Controller
 
     public function CIEFToSupplierDO(Request $request, $id)
     {
+
+        if (!is_numeric($id)) {
+            return response()->json(["message" => "Invalid id. Id needs to be a number"], 400);
+        }
+
         // Booking Exist and Belongs to User or is Admin
         if ($request->user()->role === 'member') {
             if (!$this->isUser($id, $request->user()->id)) {
@@ -472,9 +500,20 @@ class InvoiceController extends Controller
 
     }
 
-    public function CIEFToCustomerInvoice($id)
+    public function CIEFToCustomerInvoice(Request $request, $id)
     {
        
+        if (!is_numeric($id)) {
+            return response()->json(["message" => "Invalid id. Id needs to be a number"], 400);
+        }
+
+        // only allow if belongs or is admin
+        if ($request->user()->role === 'member') {
+            if (!$this->isUser($id, $request->user()->id)) {
+                return response()->json(['message' => 'The Invoice Does not belongs to you.'], 403);
+            }
+        }
+
         $booking = Booking::where('id', $id)->first();
         $invoice = Invoice::where('booking_id', $booking['id'])->first();
         $lines = InvoiceDetails::where('invoice_id', $invoice->id)->get();
@@ -531,8 +570,19 @@ class InvoiceController extends Controller
         $mpdf->Output();
     }
 
-    public function CIEFToCustomerDO($id)
+    public function CIEFToCustomerDO(Request $request, $id)
     {
+        if (!is_numeric($id)) {
+            return response()->json(["message" => "Invalid id. Id needs to be a number"], 400);
+        }
+
+        // only allow if belongs or is admin
+        if ($request->user()->role === 'member') {
+            if (!$this->isUser($id, $request->user()->id)) {
+                return response()->json(['message' => 'The Invoice Does not belongs to you.'], 403);
+            }
+        }
+
          // Generate PO
 
         $booking = Booking::where('id', $id)->first();
@@ -613,4 +663,5 @@ class InvoiceController extends Controller
         $currentstatus = InvoiceStatuses::where('invoice_id', $invoice['id'])->latest('created_at')->first()->status;
         return $currentstatus;
     }
+
 }