diff --git a/app/Http/Controllers/Projects/ProjectsController.php b/app/Http/Controllers/Projects/ProjectsController.php index 0bea489..8250fc7 100755 --- a/app/Http/Controllers/Projects/ProjectsController.php +++ b/app/Http/Controllers/Projects/ProjectsController.php @@ -120,6 +120,8 @@ class ProjectsController extends Controller public function statusUpdate(Request $request, Project $project) { + $this->authorize('update', $project); + $project = $this->repo->updateStatus($request->get('status_id'), $project->id); flash()->success(trans('project.updated')); @@ -128,6 +130,8 @@ class ProjectsController extends Controller public function jobsReorder(Request $request, Project $project) { + $this->authorize('update', $project); + if ($request->ajax()) { $data = $this->repo->jobsReorder($request->get('postData')); diff --git a/app/Policies/Projects/ProjectPolicy.php b/app/Policies/Projects/ProjectPolicy.php index 97f9eb0..20be936 100644 --- a/app/Policies/Projects/ProjectPolicy.php +++ b/app/Policies/Projects/ProjectPolicy.php @@ -134,4 +134,17 @@ class ProjectPolicy return $user->hasRole('admin') || ($user->hasRole('worker') && $user->projects->contains($project->id)); } + + /** + * Determine whether the user can see project pricings. + * + * @param \App\Entities\Users\User $user + * @param \App\Entities\Projects\Project $project + * + * @return mixed + */ + public function seePricings(User $user, Project $project) + { + return $user->hasRole('admin'); + } } diff --git a/resources/views/layouts/dashboard.blade.php b/resources/views/layouts/dashboard.blade.php index 48e22c5..8aaf9b3 100644 --- a/resources/views/layouts/dashboard.blade.php +++ b/resources/views/layouts/dashboard.blade.php @@ -10,10 +10,12 @@ 'style' => 'width:100%;max-width:350px' ]) !!} {!! Form::submit(trans('project.search'), ['class' => 'btn btn-info btn-sm']) !!} - {{ link_to_route('projects.create', trans('project.create'), [], [ - 'class' => 'btn btn-success pull-right', - 'style' => 'margin: -2px 0px;' - ]) }} + @can('create', new App\Entities\Projects\Project) + {{ link_to_route('projects.create', trans('project.create'), [], [ + 'class' => 'btn btn-success pull-right', + 'style' => 'margin: -2px 0px;' + ]) }} + @endcan {!! Form::close() !!} diff --git a/resources/views/projects/jobs/index.blade.php b/resources/views/projects/jobs/index.blade.php index c68ab20..2a01404 100755 --- a/resources/views/projects/jobs/index.blade.php +++ b/resources/views/projects/jobs/index.blade.php @@ -22,13 +22,17 @@