diff --git a/app/Http/Controllers/Accessories/AccessoriesFilesController.php b/app/Http/Controllers/Accessories/AccessoriesFilesController.php index 4f166b06d5..939ab81260 100644 --- a/app/Http/Controllers/Accessories/AccessoriesFilesController.php +++ b/app/Http/Controllers/Accessories/AccessoriesFilesController.php @@ -146,9 +146,8 @@ class AccessoriesFilesController extends Controller $this->authorize('view', $accessory); $this->authorize('accessories.files', $accessory); - if (! $log = Actionlog::find($fileId)) { - return response('No matching record for that asset/file', 500) - ->header('Content-Type', 'text/plain'); + if (! $log = Actionlog::find($fileId)->whereNotNull('filename')->where('item_id', $accessory->id)->first()) { + return redirect()->route('accessories.index')->with('error', trans('admin/users/message.log_record_not_found')); } $file = 'private_uploads/accessories/'.$log->filename; diff --git a/app/Http/Controllers/Assets/AssetFilesController.php b/app/Http/Controllers/Assets/AssetFilesController.php index a4e0605999..cfe8055bd6 100644 --- a/app/Http/Controllers/Assets/AssetFilesController.php +++ b/app/Http/Controllers/Assets/AssetFilesController.php @@ -86,7 +86,7 @@ class AssetFilesController extends Controller if (isset($asset->id)) { $this->authorize('view', $asset); - if (! $log = Actionlog::find($fileId)) { + if (! $log = Actionlog::find($fileId)->whereNotNull('filename')->where('item_id', $asset->id)->first()) { return response('No matching record for that asset/file', 500) ->header('Content-Type', 'text/plain'); } diff --git a/app/Http/Controllers/Consumables/ConsumablesFilesController.php b/app/Http/Controllers/Consumables/ConsumablesFilesController.php index def1e0d8ed..4d9d1d5f7d 100644 --- a/app/Http/Controllers/Consumables/ConsumablesFilesController.php +++ b/app/Http/Controllers/Consumables/ConsumablesFilesController.php @@ -140,7 +140,7 @@ class ConsumablesFilesController extends Controller $this->authorize('view', $consumable); $this->authorize('consumables.files', $consumable); - if (! $log = Actionlog::find($fileId)) { + if (! $log = Actionlog::find($fileId)->whereNotNull('filename')->where('item_id', $consumable->id)->first()) { return response('No matching record for that asset/file', 500) ->header('Content-Type', 'text/plain'); } diff --git a/app/Http/Controllers/Licenses/LicenseFilesController.php b/app/Http/Controllers/Licenses/LicenseFilesController.php index 442635669b..83fbc04903 100644 --- a/app/Http/Controllers/Licenses/LicenseFilesController.php +++ b/app/Http/Controllers/Licenses/LicenseFilesController.php @@ -137,7 +137,7 @@ class LicenseFilesController extends Controller $this->authorize('view', $license); $this->authorize('licenses.files', $license); - if (! $log = Actionlog::find($fileId)) { + if (! $log = Actionlog::find($fileId)->whereNotNull('filename')->where('item_id', $license->id)->first()) { return response('No matching record for that asset/file', 500) ->header('Content-Type', 'text/plain'); } diff --git a/app/Http/Controllers/Users/UserFilesController.php b/app/Http/Controllers/Users/UserFilesController.php index 62726e9827..d0778dd570 100644 --- a/app/Http/Controllers/Users/UserFilesController.php +++ b/app/Http/Controllers/Users/UserFilesController.php @@ -143,18 +143,20 @@ class UserFilesController extends Controller $this->authorize('view', $user); - $log = Actionlog::find($fileId); + if ($log = Actionlog::find($fileId)->whereNotNull('filename')->where('item_id', $user->id)->first()) { - // Display the file inline - if (request('inline') == 'true') { - $headers = [ - 'Content-Disposition' => 'inline', - ]; - return Storage::download('private_uploads/users/'.$log->filename, $log->filename, $headers); + // Display the file inline + if (request('inline') == 'true') { + $headers = [ + 'Content-Disposition' => 'inline', + ]; + return Storage::download('private_uploads/users/'.$log->filename, $log->filename, $headers); + } + + return Storage::download('private_uploads/users/'.$log->filename); } - return Storage::download('private_uploads/users/'.$log->filename); - + return redirect()->route('users.index')->with('error', trans('admin/users/message.log_record_not_found')); } // Redirect to the user management page if the user doesn't exist diff --git a/resources/lang/en/admin/users/message.php b/resources/lang/en/admin/users/message.php index adf26b3229..a3f936dcbb 100644 --- a/resources/lang/en/admin/users/message.php +++ b/resources/lang/en/admin/users/message.php @@ -15,7 +15,7 @@ return array( 'password_resets_sent' => 'The selected users who are activated and have a valid email addresses have been sent a password reset link.', 'password_reset_sent' => 'A password reset link has been sent to :email!', 'user_has_no_email' => 'This user does not have an email address in their profile.', - 'user_has_no_assets_assigned' => 'This user does not have any assets assigned', + 'log_record_not_found' => 'A matching log record for this user could not be found.', 'success' => array(