Fix access control - https://huntr.dev/bounties/19453ef1-4d77-4cff-b7…

…e8-1bc8f3af0862/
snipe · Dec 9, 2021 · 918e7c8 · 918e7c8
1 parent 86afe6c
commit 918e7c8
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/app/Http/Controllers/AssetModelsController.php b/app/Http/Controllers/AssetModelsController.php
@@ -269,6 +269,7 @@ public function show($modelId = null)
     */
     public function getClone($modelId = null)
     {
+        $this->authorize('view', AssetModel::class);
         // Check if the model exists
         if (is_null($model_to_clone = AssetModel::find($modelId))) {
             return redirect()->route('models.index')->with('error', trans('admin/models/message.does_not_exist'));