28 lines
791 B
PHP
28 lines
791 B
PHP
<?php
|
|
|
|
namespace App\Policies;
|
|
|
|
use App\Models\Project;
|
|
use App\Models\ProjectFile;
|
|
use App\Models\User;
|
|
|
|
class ProjectFilePolicy
|
|
{
|
|
/**
|
|
* Guards against IDOR: a file only downloads through the project it actually belongs to.
|
|
*/
|
|
public function download(User $user, ProjectFile $file, Project $project): bool
|
|
{
|
|
return $user->role === 'admin' && $file->revision->project_id === $project->id;
|
|
}
|
|
|
|
/**
|
|
* Same IDOR guard as download(): generating or viewing a rendered preview
|
|
* must only ever be reachable through the project the file actually belongs to.
|
|
*/
|
|
public function render(User $user, ProjectFile $file, Project $project): bool
|
|
{
|
|
return $user->role === 'admin' && $file->revision->project_id === $project->id;
|
|
}
|
|
}
|