From 7d7bc5843a18835e2b9da491fd2ecc6bfe996e38 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Munsch?= <jeremy.munsch@ldc.fr>
Date: Thu, 26 May 2022 13:18:47 +0200
Subject: [PATCH] Fix Schedule autorisation hole

---
 app/Http/Controllers/ScheduleController.php |  9 +++++++++
 resources/views/layout/nav.blade.php        | 10 +++++++++-
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/app/Http/Controllers/ScheduleController.php b/app/Http/Controllers/ScheduleController.php
index 1f555f5..525e4c9 100644
--- a/app/Http/Controllers/ScheduleController.php
+++ b/app/Http/Controllers/ScheduleController.php
@@ -17,6 +17,15 @@ use Carbon\CarbonImmutable;
  */
 class ScheduleController extends Controller
 {
+    /**
+     * ScheduleController
+     */
+    public function __construct()
+    {
+        parent::__construct();
+        $this->middleware('is-admin');
+    }
+
     public function index(Request $request)
     {
         $date    = CarbonImmutable::now()->startOfWeek();
diff --git a/resources/views/layout/nav.blade.php b/resources/views/layout/nav.blade.php
index 9ea5527..54e4da3 100644
--- a/resources/views/layout/nav.blade.php
+++ b/resources/views/layout/nav.blade.php
@@ -11,19 +11,27 @@
         @auth
         <div class="collapse navbar-collapse" id="navbarSupportedContent">
             <ul class="navbar-nav me-auto">
-                @if (Auth::user()->isAdmin())
+                @can('viewAny', App\Models\Ticket::class)
                 <li class="nav-item">
                     <a class="nav-link @if(strpos(request()->route()->getName(), 'ticket') === 0)active @endif" href="{{ route('ticket.index') }}">Tickets</a>
                 </li>
+                @endcan
+                @can('viewAny', App\Models\Site::class)
                 <li class="nav-item">
                     <a class="nav-link @if(strpos(request()->route()->getName(), 'sites') === 0)active @endif" href="{{ route('sites.index') }}">Sites</a>
                 </li>
+                @endcan
+                @can('viewAny', App\Models\Project::class)
                 <li class="nav-item">
                     <a class="nav-link @if(strpos(request()->route()->getName(), 'projects') === 0)active @endif" href="{{ route('projects.index') }}">Projets</a>
                 </li>
+                @endcan
+                @can('viewAny', App\Models\User::class)
                 <li class="nav-item">
                     <a class="nav-link @if(strpos(request()->route()->getName(), 'users') === 0)active @endif" href="{{ route('users.index') }}">Utilisateurs</a>
                 </li>
+                @endcan
+                @if(Auth::user()->isAdmin())
                 <li class="nav-item">
                     <a class="nav-link @if(strpos(request()->route()->getName(), 'schedule') === 0)active @endif" href="{{ route('schedule.index') }}">{{ __('Planning') }}</a>
                 </li>