security fix and fix parent pages

2026-07-06 02:14:16 -04:00
parent 39228168c8
commit 90f9857b06
43 changed files with 4323 additions and 132 deletions
@@ -18,6 +18,15 @@ class RequirePermission
            return response()->json(['status' => false, 'message' => 'Unauthorized.'], 401);
        }

+        $user = $request->user();
+        $status = strtolower(trim((string) ($user->status ?? '')));
+        $isVerified = filter_var($user->is_verified ?? false, FILTER_VALIDATE_BOOLEAN);
+        $isSuspended = filter_var($user->is_suspended ?? false, FILTER_VALIDATE_BOOLEAN);
+
+        if (! $isVerified || $status !== 'active' || $isSuspended) {
+            return response()->json(['message' => 'Account unavailable.'], 403);
+        }
+
        if (! $this->permissions->hasPermission($userId, $permission)) {
            if ($request->expectsJson()) {
                return response()->json(['status' => false, 'message' => 'Access denied.'], 403);