diff --git a/app/Http/Controllers/LicensesController.php b/app/Http/Controllers/LicensesController.php index 96a68be31..708d1df59 100755 --- a/app/Http/Controllers/LicensesController.php +++ b/app/Http/Controllers/LicensesController.php @@ -179,7 +179,9 @@ class LicensesController extends Controller $license->purchase_date = $request->input('purchase_date'); $license->purchase_order = $request->input('purchase_order'); $license->reassignable = $request->input('reassignable', 0); - $license->serial = $request->input('serial'); + if (Gate::allows('viewKeys', $license)) { + $license->serial = $request->input('serial'); + } $license->termination_date = $request->input('termination_date'); $license->seats = e($request->input('seats')); $license->manufacturer_id = $request->input('manufacturer_id'); diff --git a/app/Policies/LicensePolicy.php b/app/Policies/LicensePolicy.php index 0fa4f0ca7..6eb5562a1 100644 --- a/app/Policies/LicensePolicy.php +++ b/app/Policies/LicensePolicy.php @@ -13,16 +13,27 @@ class LicensePolicy extends CheckoutablePermissionsPolicy return 'licenses'; } - /** - * Determine whether the user can view license keys - * - * @param \App\Models\User $user - * @param \App\Models\License $license - * @return mixed - */ + /** + * Determine whether the user can view license keys. + * This gets a little tricky, UX/logic-wise. If a user has the ability + * to create a license (which requires a product key), shouldn't they + * have the ability to see the product key as well? + * + * Example: I create the license, realize I need to change + * something (maybe I got the product key wrong), and now I can never + * see/edit that product key. + * + * @see https://github.com/snipe/snipe-it/issues/6956 + * @param \App\Models\User $user + * @param \App\Models\License $license + * @return mixed + */ public function viewKeys(User $user, License $license = null) { - return $user->hasAccess('licenses.keys'); + if ($user->hasAccess('licenses.keys') || $user->hasAccess('licenses.create') || $user->hasAccess('licenses.edit')) { + return true; + } + return false; } } diff --git a/resources/views/licenses/checkin.blade.php b/resources/views/licenses/checkin.blade.php index d34b6e944..5db998caa 100755 --- a/resources/views/licenses/checkin.blade.php +++ b/resources/views/licenses/checkin.blade.php @@ -38,7 +38,13 @@
{{ $licenseSeat->license->serial }}
++ @can('viewKeys', $licenseSeat->license) + {{ $licenseSeat->license->serial }} + @else + ------------ + @endcan +
{{ $license->serial }}
++ @can('viewKeys', $license) + {{ $license->serial }} + @else + ------------ + @endcan +