diff --git a/app/Commands/EditAlbumCommand.php b/app/Commands/EditAlbumCommand.php index 63cc6267..b913b4df 100644 --- a/app/Commands/EditAlbumCommand.php +++ b/app/Commands/EditAlbumCommand.php @@ -22,7 +22,9 @@ namespace Poniverse\Ponyfm\Commands; use Poniverse\Ponyfm\Models\Album; use Poniverse\Ponyfm\Models\Image; +use Poniverse\Ponyfm\Models\User; use Auth; +use Gate; use DB; use Validator; @@ -48,7 +50,7 @@ class EditAlbumCommand extends CommandBase { $user = Auth::user(); - return $this->_album && $user != null && $this->_album->user_id == $user->id; + return $this->_album && $user != null && Gate::allows('edit', $this->_album); } /** @@ -61,7 +63,8 @@ class EditAlbumCommand extends CommandBase 'title' => 'required|min:3|max:50', 'cover' => 'image|mimes:png|min_width:350|min_height:350', 'cover_id' => 'exists:images,id', - 'track_ids' => 'exists:tracks,id' + 'track_ids' => 'exists:tracks,id', + 'username' => 'exists:users,username' ]; $validator = Validator::make($this->_input, $rules); @@ -86,6 +89,14 @@ class EditAlbumCommand extends CommandBase } } + if (isset($this->_input['username'])) { + $newid = User::where('username', $this->_input['username'])->first()->id; + + if ($this->_album->user_id != $newid) { + $this->_album->user_id = $newid; + } + } + $trackIds = explode(',', $this->_input['track_ids']); $this->_album->syncTrackIds($trackIds); $this->_album->save(); diff --git a/app/Http/Controllers/Api/Web/AlbumsController.php b/app/Http/Controllers/Api/Web/AlbumsController.php index f5056802..5e618e85 100644 --- a/app/Http/Controllers/Api/Web/AlbumsController.php +++ b/app/Http/Controllers/Api/Web/AlbumsController.php @@ -29,6 +29,7 @@ use Poniverse\Ponyfm\Http\Controllers\ApiControllerBase; use Poniverse\Ponyfm\Models\Image; use Poniverse\Ponyfm\Models\ResourceLogItem; use Auth; +use Gate; use Input; use Poniverse\Ponyfm\Models\User; use Response; @@ -171,7 +172,7 @@ class AlbumsController extends ApiControllerBase return $this->notFound('Album ' . $id . ' not found!'); } - if ($album->user_id != Auth::user()->id) { + if (Gate::denies('edit', Auth::user())) { return $this->notAuthorized(); } @@ -187,6 +188,7 @@ class AlbumsController extends ApiControllerBase 'id' => $album->id, 'title' => $album->title, 'user_id' => $album->user_id, + 'username' => User::whereId($album->user_id)->first()->username, 'slug' => $album->slug, 'created_at' => $album->created_at, 'published_at' => $album->published_at, diff --git a/app/Models/Album.php b/app/Models/Album.php index e3000e17..d4f2187e 100644 --- a/app/Models/Album.php +++ b/app/Models/Album.php @@ -25,6 +25,7 @@ use Helpers; use Illuminate\Database\Eloquent\Model; use Illuminate\Database\Eloquent\SoftDeletes; use Auth; +use Gate; use Cache; use Poniverse\Ponyfm\Contracts\Searchable; use Poniverse\Ponyfm\Exceptions\TrackFileNotFoundException; @@ -217,8 +218,8 @@ class Album extends Model implements Searchable ], 'user_data' => $userData, 'permissions' => [ - 'delete' => Auth::check() && Auth::user()->id == $album->user_id, - 'edit' => Auth::check() && Auth::user()->id == $album->user_id + 'delete' => Gate::allows('delete', $album), + 'edit' => Gate::allows('edit', $album) ] ]; } diff --git a/public/templates/account/album.html b/public/templates/account/album.html index d2836506..ff6bd710 100644 --- a/public/templates/account/album.html +++ b/public/templates/account/album.html @@ -20,6 +20,11 @@