From 7f489ffd68d5328aea28c114658d9e2eabee38ba Mon Sep 17 00:00:00 2001
From: Zain Fauzan Rofie Azizi <zanepojan94@gmail.com>
Date: Wed, 4 Jul 2018 10:25:23 +0800
Subject: [PATCH] add security check for user

---
 app/Http/Controllers/SoController.php | 14 +++++++++++---
 routes/api.php                        |  2 +-
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/app/Http/Controllers/SoController.php b/app/Http/Controllers/SoController.php
index 5e27163..b1e9535 100644
--- a/app/Http/Controllers/SoController.php
+++ b/app/Http/Controllers/SoController.php
@@ -5,15 +5,23 @@ namespace App\Http\Controllers;
 use Illuminate\Http\Request;
 use App\So;
 use App\Soitem;
-use App\company;
+use App\Company;
 use Auth;
 
 class SoController extends Controller
 {
 
-    public function showso($id)
+    public function show($id)
     {
+        $sos = So::where('com_id', Auth::user()->company())->get();
+
+        if (!$sos)
+        {
+            return response()->json(['message'=>'Access Denied!'], 404);
+        }
+
         $so = So::findOrFail($id);
+        
         return view('home')->with('so', $so);
     }
 
@@ -74,7 +82,7 @@ class SoController extends Controller
      */
     public function cancelOrder(Request $request)
     {
-
+        
         if (!$so = So::where('com_id', Auth::user()->company())->where('id', $id)->first())
 		{
 			return response()->json(['message'=>'Access denied'], 200);
diff --git a/routes/api.php b/routes/api.php
index 8eba037..e1eb010 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -30,7 +30,7 @@ Route::group(['middleware' => ['jwt.auth']], function() {
     });
 
     /* shipping order */
-    Route::get('/so', 'SoController@showso');//get the shipping order
+    Route::get('/so', 'SoController@show');//get the shipping order
     Route::post('/so', 'SoController@store');//store shipping order 
     Route::delete('/so/{so_id}', 'SoController@delete');// delete the shipping order
     Route::put('/so/{so_id}/cancelOrder', 'SoController@cancelOrder');//post the cancel order