php - Laravel prevent users from editing/viewing other users' resources -

in laravel app have multiple user accounts have resources assigned them. say, example, "payment". edit or view payment user visit /payment/edit/{payment} route (where payment payment id).

although have auth filter stop un-logged in users accessing page there nothing stop, example, user 1 editing user 2's payment.

is there filter can user checks user payment (or other resource) belongs prevent kind of issue?

[i using laravel's model bindings automatically fetches model specified route rather me in controller using eloquent.]

no such filter exists default, can create 1 (depending on how database set up). within app/filters.php, may this:

route::filter('restrictpermission', function($route) {     $payment_id = $route->parameter('payment');      if (!auth::user()->payments()->find($payment_id)) return redirect::to('/'); }); 

this compares logged in user's payment_id (in database) {payment} argument passed route. obviously, depending on how database set (for instance if payment_id in separate table) need change conditional.

then, apply filter route:

route::get('/payment/edit/{payment}', array('before' => 'restrictpermission'));