如何限制直接链接的删除权限?

时间:2019-07-15 06:41:02

标签: php database laravel

我有2个问题,需要您的帮助。首先,我已删除评论的途径,但是其他登录的用户也可以从直接链接中删除评论... link.com/deleteComment/id。如何将其仅对评论的所有者可用?所有者ID保存在数据库中,可以用{{ $comment->user_id }}访问。

第二个问题...在我看来,当我单击没有评论的照片时,我收到undefined variable comment,但我不知道为什么,因为在有评论的照片上,我没有问题我可以制作类似if comments != empty, dont show it之类的东西吗?

CommentsController:

 public function store(Request $request, $post_id)
    {
        $this->validate($request, array(

            'comment' => 'required|min:5|max:2000',
        ));


        $post = Post::find($post_id);

        $comment = new Comment();
        $comment->username = Auth::user()->username;
        $comment->email = Auth::user()->email;
        $comment->user_id = Auth::user()->id;
        $comment->comment = $request->comment;
        $comment->approved = true;
        $comment->post()->associate($post);

        $comment->save();
        Session::flash('message', "Message posted successfully!");
        return Redirect::back();
    }

PostsController:

    public function delete($id){

        DB::table('posts')->where('id',$id)->delete();

        return redirect('/profile/' . auth()->user()->id);
    }

我的观点

@foreach($post->comments as $comment)

          <div class="comment d-flex ">

            <p><strong><a class="text-dark" href="/profile/{{ $comment->user_id }}">{{ $comment->username}}</a>: </strong> {{ $comment->comment}}</p>
       @can('update', $post->user->profile)
    <div class="dropdown col-md-6">
    <button type="button" class="btn btn-primary dropdown-toggle btn-sm" style="background-color: #ffffff00;border: 1px solid #555;color: black;padding: 0 5px" data-toggle="dropdown">
      Select
    </button>
    <div class="dropdown-menu">
      <a class="dropdown-item" href="#">Edit comment</a>
      <a class="dropdown-item" title="Options" style="text-decoration: none;" href="/deleteComment/{{$comment->id}}">Delete comment</a>
    </div>
  </div>

          </div>
@endcan
          @endforeach

我的路线

Route::post('comments/{post_id}', ['uses' => 'CommentsController@store', 'as' => 'comments.store']);

Route::get('/deleteComment/{id}', 'CommentsController@delete');

2 个答案:

答案 0 :(得分:0)

第一个问题可以轻松完成。在您的destroy()函数中,只需检查评论所有者:

// Check comment owner    
if($comment->user_id != \Auth::id()){
   return abort(401);
}

// Do logic code to delete comment.

第二个问题,您可以检查是否存在这样的评论:

if(! $comments->isEmpty()) {
  // Do logic code to show comment
}

答案 1 :(得分:0)

尝试执行此操作,以仅对拥有评论的经过身份验证的用户限制删除操作:

Intent intent = null;
try {
    intent = new Intent(this, 
       Class.forName("ir.test.testlibary1.HelloWorldActivity"));
    startActivity(intent);
} catch (ClassNotFoundException e) {
    e.printStackTrace();
}

对于第二个问题,我认为发生的事情是没有注释就使用了没有结果的变量。

您可以尝试在此使用$ comments变量将语句括起来。

对于Controller或其他文件php

/**
 *  Comments Controller Method Delete
 */
public function delete($id){

    if(!DB::table('comments')->where('id',$id)->where('user_id',auth()->user()->id)->delete()){
        Session::flash('remove', "You do not have permission to delete the comment!");
    }else{
        Session::flash('remove', "Message removed successfully!");
    }

    return Redirect::back();
}

对于Blade

if (!$comment->isEmpty()) { 
//your code 
}
if ($comment->count()) { 
//your code 
}
if (count($comment)) { 
//your code 
}

我希望我能为您提供帮助,如果不能,请附加更多代码,使它们准确显示在他所说的位置,然后注释并删除图片,因为我没有看到您所附加的代码。谢谢,祝你好运。

参考

$comment->isEmpty

$comment->count() and count($comment)

已更新

@if(!$comment->isEmpty()) 
//your code 
@endif
@if($comment->count()) 
//your code 
@endif
@if(count($comment)) 
//your code
@endif

已更新为删除(如果管理员为否)

<div class="row">
    <div class="col-md-12">
        @if(!$post->comments->isEmpty()) //****Added
            @if($post->comments->count() > 0)
                @foreach($post->comments as $comment)

                    <div class="comment d-flex ">

                        <p><strong><a class="text-dark"
                                      href="/profile/{{ $comment->user_id }}">{{ $comment->username}}</a>:
                            </strong> {{ isset($comment->comment) ? $comment->comment : "--" }}</p>
                        @can('update', $post->user->profile)

                            <div class="dropdown col-md-6">
                                <button type="button" class="btn btn-primary dropdown-toggle btn-sm"
                                        style="background-color: #ffffff00;border: 1px solid #555;color: black;padding: 0 5px"
                                        data-toggle="dropdown">
                                    Select
                                </button>
                                <div class="dropdown-menu">
                                    <a class="dropdown-item" href="#">Edit comment</a>
                                    <a class="dropdown-item" title="Options" style="text-decoration: none;"
                                       href="/deleteComment/{{$comment->id}}">Delete comment</a>
                                </div>
                            </div>

                    </div>
                    @endcan

                @endforeach
            @endif
        @endif //****Added
    </div>
</div>