← All changes | app/Http/Policies/UserPolicy.php +13 -1 2.0.10 → 2.1.0 View file →

		@@ -15,9 +15,21 @@
15	15	*/
16	16	public function verifyRequest(Request $request)
17	17	{
18	18	// Check if user has access to the app
19		- return PermissionManager::hasAppAccess();
	19	+ if (!PermissionManager::hasAppAccess()) {
	20	+ return false;
	21	+ }
	22	+
	23	+ // Match the controller's URL target; query/body parameters must not override it.
	24	+ $routeParams = $request->get_url_params();
	25	+ if (!array_key_exists('id', $routeParams)) {
	26	+ return true;
	27	+ }
	28	+
	29	+ $targetUserId = intval($routeParams['id']);
	30	+
	31	+ return $targetUserId > 0 && PermissionManager::userCanAccessMemberProfile($targetUserId);
20	32	}
21	33
22	34	public function globalSearch(Request $request)
23	35	{