cief/exchange
1
0
Fork 0
mirror of https://gitlab.com/CIEFWorldwideSdnBhd/exchange.git synced 2026-08-19 12:24:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

security validation for Invoice Controller

Browse Source
This commit is contained in:
Edmond Teh
2020-09-14 17:56:42 +08:00
parent f7f62fb677
commit b6d6db1a5b
1 changed files with 57 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Http/Controllers/InvoiceController.php
+57 -6
View File
@@ -22,9 +22,19 @@ use PDF;
class InvoiceController extends Controller
{
public function show($id)
public function show(Request $request, $id)
{
// validate $id is number
if (!is_numeric($id)) {
return response()->json(["message" => "Invalid id. Id needs to be a number"], 400);
}
// only allow if belongs or is admin
if ($request->user()->role === 'member') {
if (!$this->isUser($id, $request->user()->id)) {
return response()->json(['message' => 'The Invoice Does not belongs to you.'], 403);
}
}
$invoice = Invoice::where('booking_id', $id)->first();
if (!$invoice) {
@@ -45,6 +55,9 @@ class InvoiceController extends Controller
$user = $request->user();
// validate $id
if (!is_numeric($id)) {
return response()->json(["message" => "Invalid id. Id needs to be a number"], 400);
}
$validatedData = $request->validate([
'address' => 'required',
@@ -70,7 +83,7 @@ class InvoiceController extends Controller
// user_id in booking does not match
if ($booking->user_id !== $user->id) {
return response()->json([
'message' => 'Booking does not belongs to you'
'message' => 'Booking does not belongs to you.'
], 403);
}
@@ -140,7 +153,7 @@ class InvoiceController extends Controller
$status->save();
if($invoice_details) {
return $this->show($id);
return $this->show($request, $id);
} else {
return response(500);
}
@@ -151,6 +164,9 @@ class InvoiceController extends Controller
$user = $request->user();
// validate $id
if (!is_numeric($id)) {
return response()->json(["message" => "Invalid id. Id needs to be a number"], 400);
}
$validatedData = $request->validate([
'address' => 'required',
@@ -256,7 +272,7 @@ class InvoiceController extends Controller
$status->save();
if($invoice_details) {
return $this->show($id);
return $this->show($request, $id);
} else {
return response(500);
}
@@ -266,6 +282,9 @@ class InvoiceController extends Controller
{
// validate $id is integer
if (!is_numeric($id)) {
return response()->json(["message" => "Invalid id. Id needs to be a number"], 400);
}
$validatedData = $request->validate([
'status' => ['required', Rule::in('request_change', 'approve')],
@@ -314,6 +333,10 @@ class InvoiceController extends Controller
public function customerToCIEFPO(Request $request, $id)
{
if (!is_numeric($id)) {
return response()->json(["message" => "Invalid id. Id needs to be a number"], 400);
}
// Booking Exist and Belongs to User or is Admin
if ($request->user()->role === 'member') {
if (!$this->isUser($id, $request->user()->id)) {
@@ -394,6 +417,11 @@ class InvoiceController extends Controller
public function CIEFToSupplierDO(Request $request, $id)
{
if (!is_numeric($id)) {
return response()->json(["message" => "Invalid id. Id needs to be a number"], 400);
}
// Booking Exist and Belongs to User or is Admin
if ($request->user()->role === 'member') {
if (!$this->isUser($id, $request->user()->id)) {
@@ -472,9 +500,20 @@ class InvoiceController extends Controller
}
public function CIEFToCustomerInvoice($id)
public function CIEFToCustomerInvoice(Request $request, $id)
{
if (!is_numeric($id)) {
return response()->json(["message" => "Invalid id. Id needs to be a number"], 400);
}
// only allow if belongs or is admin
if ($request->user()->role === 'member') {
if (!$this->isUser($id, $request->user()->id)) {
return response()->json(['message' => 'The Invoice Does not belongs to you.'], 403);
}
}
$booking = Booking::where('id', $id)->first();
$invoice = Invoice::where('booking_id', $booking['id'])->first();
$lines = InvoiceDetails::where('invoice_id', $invoice->id)->get();
@@ -531,8 +570,19 @@ class InvoiceController extends Controller
$mpdf->Output();
}
public function CIEFToCustomerDO($id)
public function CIEFToCustomerDO(Request $request, $id)
{
if (!is_numeric($id)) {
return response()->json(["message" => "Invalid id. Id needs to be a number"], 400);
}
// only allow if belongs or is admin
if ($request->user()->role === 'member') {
if (!$this->isUser($id, $request->user()->id)) {
return response()->json(['message' => 'The Invoice Does not belongs to you.'], 403);
}
}
// Generate PO
$booking = Booking::where('id', $id)->first();
@@ -613,4 +663,5 @@ class InvoiceController extends Controller
$currentstatus = InvoiceStatuses::where('invoice_id', $invoice['id'])->latest('created_at')->first()->status;
return $currentstatus;
}
}