jeudi 24 septembre 2015

Verify that current user owns the requesting project

I am pretty sure I want to use middleware here, but not sure how. I have a controller called AssetController.

Users upload files to their own projects. I have functions in the controller that can create a new asset, edit an existing and delete an asset. Right now inside each of those respective functions I check if the requesting user actually owns that project using this code (I pass the project_id to every request):

<?php
public function destroy($id)
{
  $project = Projects::find(Input::get('pid'));
  //-- if $project exists and the user_id row is equal to the authenticated user id, let them proceeed
  if ($project && $project->user_id == Auth::user()->id)
  {
    //-- user owns the project so continue to delete asset with id of $id
  }
  //-- else, invalid project id because this user does not own it
}

So rather than using that if block in every function, how would I use middleware (if that is even what I am supposed to use) to do this check before continuing to the actual function I want to call.

Right now my __construct() function just has this:

public function __construct()
{
  $this->middleware('auth');
}



via Chebli Mohamed

Aucun commentaire:

Enregistrer un commentaire