Restricting access to thread participants only.

[ronlinet]

Thank you for the demo guys.
I am reusing it now in my project and I have noticed that the thread page doesn’t check if the user is a participant or not.

Adding below snippet to MessagesController.php#L60 will redirect “non participants” back to the listing page with an error message.

$participant = Participant::where(['user_id' => Auth::id(), 'thread_id' => $id ]);
if( is_null($participant->first())) {
   \Session::flash('error_message', 'Only For Participants');
   return redirect()->back();
}

[cmgmyr]

hey @ronlinet, thanks for the discussion thread and using the package!

Correct, we handle the basics in the package. It's up to the application code to determine authorization for gaining access to message/thread features.