soheilkhaledabadi/law-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixed api issue

Browse Source
This commit is contained in:
m.razaghi
2026-07-16 17:51:10 +03:30
parent 209b1f2530
commit cf0f8f0c3f
1 changed files with 14 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
app/Http/Controllers/api/FolderController.php
View File

@@ -99,9 +99,9 @@ class FolderController extends Controller
public function folder($id)
{
// 🚨 SECURITY FIX: Check user_id when fetching the folder contents
// Added 'arts.law.category' so we can fetch category_name without slowing down the DB
$folder = Folder::with([
'arts.chapter', 'arts.part', 'arts.volum', 'arts.law', 'arts.book', 'arts.section', 'arts.gate',
'arts.chapter', 'arts.part', 'arts.volum', 'arts.law.category', 'arts.book', 'arts.section', 'arts.gate',
'bylaws.category', 'bylaws.approvalAuthority', 'bylaws.promulgationAuthority',
'judicialPrecedents.category',
'legalOpinions.category'
@@ -118,7 +118,7 @@ class FolderController extends Controller
$text = $art->text ?? '';
$shortText = '';
if (strlen($text) > 50) {
$shortText = mb_substr($text, 0, 50); // Changed to mb_substr for Persian text safety
$shortText = mb_substr($text, 0, 50);
$shortText = mb_substr($shortText, 0, mb_strrpos($shortText, ' ')).'...';
} else {
$shortText = $text;
@@ -133,6 +133,16 @@ class FolderController extends Controller
'is_locked' => $isLocked,
'type' => 'art',
'assigned_at' => $art->pivot->created_at,
'law_title' => $art->law?->title,
'category_name' => $art->law?->category?->name,
'law' => $art->law != null ? [
'id' => $art->law->id,
'title' => $art->law->title,
'number' => $art->law->number,
] : null,
'chapter' => $art->chapter != null ? [
'id' => $art->chapter->id,
'title' => $art->chapter->title,
@@ -148,11 +158,6 @@ class FolderController extends Controller
'title' => $art->volum->title,
'number' => $art->volum->number,
] : null,
'law' => $art->law != null ? [
'id' => $art->law->id,
'title' => $art->law->title,
'number' => $art->law->number,
] : null,
'book' => $art->book != null ? [
'id' => $art->book->id,
'title' => $art->book->title,
@@ -217,7 +222,6 @@ class FolderController extends Controller
public function delete_folder($id)
{
// 🚨 SECURITY FIX
$folder = Folder::where('id', $id)->where('user_id', auth()->id())->first();
if (!$folder) {
@@ -228,7 +232,6 @@ class FolderController extends Controller
return $this->success([], 'حذف شد', 'پوشه با موفقیت حذف شد');
}
// 🚨 SECURITY FIX FOR ALL PIVOT DELETES: Verify the folder belongs to the user first!
private function checkFolderOwnership($folder_id)
{
return Folder::where('id', $folder_id)->where('user_id', auth()->id())->exists();
@@ -279,7 +282,7 @@ class FolderController extends Controller
}
/* -----------------------------------------------------------------
* FORMATTING HELPERS (Safely cloned from GlobalSearch)
* FORMATTING HELPERS
* ----------------------------------------------------------------- */
private function isLockedForCurrentUserGeneric($item): bool