missing permission check in portal

akaunting · Jun 24, 2020 · aa3e2e8 · aa3e2e8
1 parent 46cd0ab
commit aa3e2e8
Showing 1 changed file with 7 additions and 2 deletions.
diff --git a/app/Listeners/Menu/AddPortalItems.php b/app/Listeners/Menu/AddPortalItems.php
@@ -14,12 +14,17 @@ class AddPortalItems
      */
     public function handle(Event $event)
     {
+        $user = user();
         $menu = $event->menu;
 
         $menu->route('portal.dashboard', trans_choice('general.dashboards', 1), [], 100, ['icon' => 'fa fa-tachometer-alt']);
 
-        $menu->route('portal.invoices.index', trans_choice('general.invoices', 2), [], 200, ['icon' => 'fa fa-file-signature']);
+        if ($user->can('read-portal-invoices')) {
+            $menu->route('portal.invoices.index', trans_choice('general.invoices', 2), [], 200, ['icon' => 'fa fa-file-signature']);
+        }
 
-        $menu->route('portal.payments.index', trans_choice('general.payments', 2), [], 300, ['icon' => 'fa fa-money-bill']);
+        if ($user->can('read-portal-payments')) {
+            $menu->route('portal.payments.index', trans_choice('general.payments', 2), [], 300, ['icon' => 'fa fa-money-bill']);
+        }
     }
 }