javier
941dbd5997
Restores all files to thef8a1310security-review snapshot as requested, plus the 2 boot-critical fixes froma24c8a2(config/session.php env() instead of app()->environment(), and removal of the duplicate $activeTab in ProjectMap.php) so the application actually boots. Forward commit, no history rewrite. The7d854ffstate remains in history. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
42 lines
1.2 KiB
PHP
42 lines
1.2 KiB
PHP
<?php
|
|
|
|
namespace App\Livewire;
|
|
|
|
use Livewire\Component;
|
|
use Livewire\WithPagination;
|
|
use App\Models\Project;
|
|
use Illuminate\Support\Facades\Auth;
|
|
|
|
class ProjectList extends Component
|
|
{
|
|
use WithPagination;
|
|
|
|
public $search = '';
|
|
public $statusFilter = '';
|
|
|
|
public function deleteProject($id)
|
|
{
|
|
$user = Auth::user();
|
|
if (!$user->can('delete projects')) {
|
|
session()->flash('error', 'Sin permisos para eliminar proyectos.');
|
|
return;
|
|
}
|
|
// Scope to accessible projects to prevent IDOR (deleting another user's project by ID)
|
|
$project = Project::accessibleBy($user)->findOrFail($id);
|
|
$project->delete();
|
|
session()->flash('message', 'Proyecto eliminado');
|
|
}
|
|
|
|
public function render()
|
|
{
|
|
$query = Project::accessibleBy(Auth::user());
|
|
if ($this->search) {
|
|
$query->where('name', 'like', '%' . $this->search . '%');
|
|
}
|
|
if ($this->statusFilter) {
|
|
$query->where('status', $this->statusFilter);
|
|
}
|
|
$projects = $query->with('phases')->latest()->paginate(10);
|
|
return view('livewire.projects.project-list', ['projects' => $projects]);
|
|
}
|
|
} |