1
I created a middleware to check if the person who wants to manipulate a post owns this one or if it’s the super admin. Behold:
public function handle($request, Closure $next)
{
$user = \Auth::user();
$postId = $request->route('post');
$post = $user->posts->where('id', $postId)->first();
if ($user->id == 2 || @$post->user_id == $user->id) {
return $next($request);
}
return redirect()->route('post.index')
->with(['status' => 'danger', 'mensagem' => 'Este post não te pertence!']);
}
But in this passage:
if ($user->id == 2 || @$post->user_id == $user->id) {
I had to enter a @ to suppress an error that occurs when the post not being manipulated is not related to the session user. Do you have a more appropriate way of making that same logic but without inserting one more if?
If you are using L5.3 you are searching for this: https://laravel.com/docs/5.3/authorization
– juniorb2ss