From d7025b7f86f7452975805908117a5eac7ade24f5 Mon Sep 17 00:00:00 2001
From: Nazri <nazhamz95@gmail.com>
Date: Thu, 31 May 2018 10:38:45 +0800
Subject: [PATCH] update logic

---
 app/Http/Controllers/BookingController.php | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/app/Http/Controllers/BookingController.php b/app/Http/Controllers/BookingController.php
index 4ec2c00d..6046ce03 100644
--- a/app/Http/Controllers/BookingController.php
+++ b/app/Http/Controllers/BookingController.php
@@ -15,13 +15,6 @@ class BookingController extends Controller
 
     public function store(Request $request)
     {
-        //logic if booking is not belongs to user, prohibit them from accessing the api
-        $user = User::where("id", Auth::user()->id)->first();
-        if (!$user)
-        {
-            return response()->json(['message'=>'Access denied'],401);
-        }
-
         $rates = Rate::all()->last();
         $term = $request->input('term');
         $rate = 1;
@@ -122,6 +115,12 @@ class BookingController extends Controller
 
     public function uploadbankslip(Request $request, $id)
     {
+        $post = User::find($id);
+        if (!$post)
+        {
+            return response()->json(['message'=>'Access denied'],401);
+        }
+
         // Handle File Upload
         if($request->hasFile('bankslip_url')){
             // Get filename with the extension
@@ -156,6 +155,12 @@ class BookingController extends Controller
 
     public function uploadPurchaseOrder(Request $request, $id)
     {
+        $post = User::where("user_id", Auth::user()->id)->first();
+        if (!$post)
+        {
+            return response()->json(['message'=>'Access denied'], 401);
+        }
+
         // Handle File Upload
         if($request->hasFile('image_url')){
             // Get filename with the extension