diff --git a/sourcecode/hub/app/Http/Requests/ContentFilter.php b/sourcecode/hub/app/Http/Requests/ContentFilter.php index e8fa45c12..155fd6dd9 100644 --- a/sourcecode/hub/app/Http/Requests/ContentFilter.php +++ b/sourcecode/hub/app/Http/Requests/ContentFilter.php @@ -314,7 +314,8 @@ private function attachModel(array $hits, bool $forUser, bool $showDrafts): Coll $eagerLoad = ['users']; if ($showDrafts) { $eagerLoad[] = 'latestVersion'; - } else { + } + if (!$showDrafts || $forUser) { $eagerLoad[] = 'latestPublishedVersion'; } @@ -331,7 +332,7 @@ private function attachModel(array $hits, bool $forUser, bool $showDrafts): Coll ?? throw new NotFoundHttpException(); $canUse = Gate::allows('use', [$model, $version]); - $canEdit = Gate::allows('edit', $model); + $canEdit = Gate::allows('edit', [$model, $version]); $canView = Gate::allows('view', $model); $canDelete = $forUser && Gate::allows('delete', $model); $canCopy = Gate::allows('copy', $model); @@ -349,7 +350,7 @@ private function attachModel(array $hits, bool $forUser, bool $showDrafts): Coll useUrl: $canUse ? route('content.use', [$model, $version]) : null, editUrl: $canEdit ? route('content.edit', [$model, $version]) : null, shareUrl: $canView ? route('content.share', [$model, SessionScope::TOKEN_PARAM => null]) : null, - copyUrl: $canCopy ? route('content.copy', [$model, $version]) : null, + copyUrl: $canCopy ? route('content.copy', [$model]) : null, deleteUrl: $canDelete ? route('content.delete', [$model]) : null, ); }); diff --git a/sourcecode/hub/app/Policies/ContentPolicy.php b/sourcecode/hub/app/Policies/ContentPolicy.php index 0391a5f32..571237c5a 100644 --- a/sourcecode/hub/app/Policies/ContentPolicy.php +++ b/sourcecode/hub/app/Policies/ContentPolicy.php @@ -129,10 +129,6 @@ public function use(User|null $user, Content $content, ContentVersion $version): return false; } - if (!$version->content?->is($content)) { - return false; - } - if (!$version->published) { return false; } @@ -151,7 +147,13 @@ public function manageRoles(User $user, Content $content): bool private function ensureVersionBelongsToContent(Content $content, ContentVersion|null $version): void { - if ($version && !$version->content?->is($content)) { + if ($version && ( + $version->content_id !== $content->id || + $version->exists === false || + $content->exists === false || + $version->getConnectionName() !== $content->getConnectionName() + ) + ) { throw new LogicException('Version does not belong to content'); } }