Add delete function to EarningPolicy to protect destroy@EarningsController
MODIFY
app/Http/Controllers/EarningsController.php
app/Http/Controllers/EarningsController.php
@@ -38,9 +38,7 @@ class EarningsController extends Controller {
return view('earnings.show', compact('currency', 'earning'));
}
- public function destroy($id) {
- $earning = Earning::find($id);
-
+ public function destroy(Earning $earning) {
$year = date('Y', strtotime($earning->date));
$month = date('n', strtotime($earning->date));

MODIFY
app/Policies/EarningPolicy.php
app/Policies/EarningPolicy.php
@@ -9,4 +9,8 @@ class EarningPolicy {
public function view(User $user, Earning $earning) {
return $user->id === $earning->user_id;
}
+
+ public function delete(User $user, Earning $earning) {
+ return $user->id === $earning->user_id;
+ }
}

MODIFY
routes/web.php
routes/web.php
@@ -16,7 +16,7 @@ Route::group(['middleware' => ['auth']], function () {
Route::get('/earnings/create', 'EarningsController@create')->name('earnings.create');
Route::post('/earnings', 'EarningsController@store');
Route::get('/earnings/{earning}', 'EarningsController@show')->name('earnings.show')->middleware('can:view,earning');
- Route::delete('/earnings/{id}', 'EarningsController@destroy');
+ Route::delete('/earnings/{earning}', 'EarningsController@destroy')->middleware('can:delete,earning');
Route::get('/spendings/create', 'SpendingsController@create')->name('spendings.create');
Route::post('/spendings', 'SpendingsController@store');

Add delete function to EarningPolicy to protect destroy@EarningsController