3

I have a Laravel project where users have roles with permissions(I'm using Zizaco/entrust) and the app is accessable just for registered user.

The application holds uploaded documents but this documents should not available for public view, on the other side this documents should be accessable in function of users permission.

My question: how to go in this case, how to protect documents in function of users permission?

fefe
  • 8,755
  • 27
  • 104
  • 180

1 Answers1

1

I'm not sure if this will help, but you can create a special Controller for downloading/showing a document, where you can check permissions of a actual user.

From Entrust documentation, you can check if user should be able to see the document:

$user->hasRole('owner'); //returns boolean

So you can use this code from below in a Controller:

$user = User::where('username', '=', 'Mark')->first();    
$pathToFile = Storage::get('file.pdf');
if ($user->hasRole('admin'))
{
    return response()->download($pathToFile); //if you want to display a file, then change download to file
}
else
{
    abort(403, 'Unauthorized action.');
}

Remember about adding this line to your controller: 

use Zizaco\Entrust\Traits\EntrustUserTrait;

You can read more about responses here: https://laravel.com/docs/5.4/responses and files here: https://laravel.com/docs/5.4/filesystem

Look here for short syntax which will help you implement file downloads in routes.php without creating a new controller. https://github.com/Zizaco/entrust#short-syntax-route-filter

RaczeQ
  • 121
  • 3
  • 6