From e37106f2dcf334111954a4f1f3b89147d1a9419e Mon Sep 17 00:00:00 2001 From: baodev0 Date: Wed, 28 Oct 2026 16:43:43 +0700 Subject: [PATCH] =?UTF-8?q?fix(service):=20ch=E1=BB=89=20tr=E1=BA=A3=20m?= =?UTF-8?q?=E1=BA=ADt=20kh=E1=BA=A9u=20hosting=20cho=20admin=20c=C3=B3=20q?= =?UTF-8?q?uy=E1=BB=81n=20hosting.view?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GET administrator/services/{id} chỉ yêu cầu customer.view nhưng trả kèm mật khẩu Plesk dạng rõ; giờ chỉ đính kèm khi là Full Administrator hoặc có hosting.view. Co-Authored-By: Claude Sonnet 5.5 --- app/Http/Controllers/Api/Admin/Service/ServiceController.php | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/app/Http/Controllers/Api/Admin/Service/ServiceController.php b/app/Http/Controllers/Api/Admin/Service/ServiceController.php index 9f2eb1c..f6ccaa2 100644 --- a/app/Http/Controllers/Api/Admin/Service/ServiceController.php +++ b/app/Http/Controllers/Api/Admin/Service/ServiceController.php @@ -94,7 +94,10 @@ class ServiceController extends Controller ->findOrFail($id); ModuleVmware::resolveVirtualMachineIds([$service->vmware]); - \App\Support\HostingCredentials::attach([$service]); + $admin = auth()->guard('admin')->user(); + if ($admin?->hasRole('Full Administrator') || $admin?->hasPermissionTo('hosting.view')) { + \App\Support\HostingCredentials::attach([$service]); + } $invoices = $this->linkedInvoices(collect([$service])); $payments = InvoicePaymentHistory::forInvoices($invoices);