← All changes | app/Http/Policies/AvailabilityPolicy.php +10 -5 1.5.21 → trunk View file →

		@@ -14,19 +14,24 @@
14	14	* @return Boolean
15	15	*/
16	16	public function verifyRequest(Request $request)
17	17	{
18		- if (current_user_can('manage_options') || PermissionManager::userCan('manage_other_availabilities')) {
	18	+ if (PermissionManager::userCan(['manage_all_data', 'manage_other_availabilities'])) {
19	19	return true;
20	20	}
21	21
22		- if ($request->method() == 'GET' && PermissionManager::userCan('read_and_use_other_availabilities')) {
	22	+ if ($request->getMethod() == 'GET' && PermissionManager::userCan('read_and_use_other_availabilities')) {
23	23	return true;
24	24	}
25	25
26		- if ($request->schedule_id) {
27		- $availability = \FluentBooking\App\Models\Availability::find($request->schedule_id);
28		-
	26	+ // Resolve the schedule from the URL route only — request-body values
	27	+ // must not be permitted to redirect the authorization target.
	28	+ $urlParams = (array) $request->get_url_params();
	29	+ $scheduleId = isset($urlParams['schedule_id']) ? (int) $urlParams['schedule_id'] : 0;
	30	+
	31	+ if ($scheduleId) {
	32	+ $availability = \FluentBooking\App\Models\Availability::find($scheduleId);
	33	+
29	34	if (!$availability) {
30	35	return false;
31	36	}
32	37