Only allow admins/super admins to delete or resend from unaccepted items

2026-04-29 17:18:05 +01:00
parent ac4975e1d1
commit a0bf7a018c
1 changed files with 8 additions and 0 deletions
@@ -1230,6 +1230,10 @@ class ReportsController extends Controller
     */
    public function sentAssetAcceptanceReminder(Request $request): RedirectResponse
    {
+        $user = auth()->user();
+        if (! ($user?->isAdmin() || $user?->isSuperUser())) {
+            abort(403);
+        }
        $this->authorize('reports.view');
        $id = $request->input('acceptance_id');
        $query = CheckoutAcceptance::query()
@@ -1317,6 +1321,10 @@ class ReportsController extends Controller
     */
    public function deleteAssetAcceptance($acceptanceId = null): RedirectResponse
    {
+        $user = auth()->user();
+        if (! ($user?->isAdmin() || $user?->isSuperUser())) {
+            abort(403);
+        }
        $this->authorize('reports.view');

        if (! $acceptance = CheckoutAcceptance::pending()->find($acceptanceId)) {