fixed #226

akaunting · Feb 23, 2018 · b19b3c3 · b19b3c3
1 parent 09e66c5
commit b19b3c3
Showing 1 changed file with 14 additions and 11 deletions.
diff --git a/app/Http/Controllers/Common/Uploads.php b/app/Http/Controllers/Common/Uploads.php
@@ -4,17 +4,16 @@
 
 use App\Http\Controllers\Controller;
 use App\Models\Common\Media;
-use Storage;
 use File;
+use Storage;
 
 class Uploads extends Controller
 {
     /**
      * Get the specified resource.
      *
-     * @param  $folder
-     * @param  $file
-     * @return boolean|Response
+     * @param  $id
+     * @return mixed
      */
     public function get($id)
     {
@@ -31,9 +30,8 @@ public function get($id)
     /**
      * Download the specified resource.
      *
-     * @param  $folder
-     * @param  $file
-     * @return boolean|Response
+     * @param  $id
+     * @return mixed
      */
     public function download($id)
     {
@@ -50,8 +48,7 @@ public function download($id)
     /**
      * Destroy the specified resource.
      *
-     * @param  $folder
-     * @param  $file
+     * @param  $id
      * @return callable
      */
     public function destroy($id)
@@ -77,15 +74,21 @@ public function destroy($id)
     /**
      * Get the full path of resource.
      *
-     * @param  $folder
-     * @param  $file
+     * @param  $media
      * @return boolean|string
      */
     protected function getPath($media)
     {
         $path = $media->basename;
 
         if (!empty($media->directory)) {
+            $folders = explode('/', $media->directory);
+
+            // Check if company can access media
+            if ($folders[0] != session('company_id')) {
+                return false;
+            }
+
             $path = $media->directory . '/' . $media->basename;
         }