From caa3ff00be866e62ed5b2b82f9db8ec4ea21aa40 Mon Sep 17 00:00:00 2001
From: Dan Harrin <git@danharrin.com>
Date: Sun, 11 Apr 2021 21:26:10 +0100
Subject: [PATCH] fix

---
 src/Pages/Page.php                           | 12 ++++------
 src/Resources/Pages/CreateRecord.php         |  2 ++
 src/Resources/Pages/EditRecord.php           | 25 +++++++++++++-------
 src/Resources/Pages/ListRecords.php          |  5 ++++
 src/Resources/RelationManager/EditRecord.php |  4 ++--
 5 files changed, 31 insertions(+), 17 deletions(-)

diff --git a/src/Pages/Page.php b/src/Pages/Page.php
index 6d326fbd16..13993eb122 100644
--- a/src/Pages/Page.php
+++ b/src/Pages/Page.php
@@ -22,13 +22,6 @@ class Page extends Component
 
     public static $view;
 
-    public function __invoke(Container $container, \Illuminate\Routing\Route $route)
-    {
-        abort_unless($this->isAuthorized(), 403);
-
-        return parent::__invoke($container, $route);
-    }
-
     public static function authorization()
     {
         return [];
@@ -95,6 +88,11 @@ class Page extends Component
         return Filament::can('view', static::class);
     }
 
+    protected function abortIfForbidden()
+    {
+        abort_unless($this->isAuthorized(), 403);
+    }
+
     public static function navigationItems()
     {
         return [
diff --git a/src/Resources/Pages/CreateRecord.php b/src/Resources/Pages/CreateRecord.php
index a6ba3d4300..999e9dc8f5 100644
--- a/src/Resources/Pages/CreateRecord.php
+++ b/src/Resources/Pages/CreateRecord.php
@@ -74,6 +74,8 @@ class CreateRecord extends Page
     public function mount()
     {
         $this->fillRecord();
+
+        $this->abortIfForbidden();
     }
 
     protected function actions()
diff --git a/src/Resources/Pages/EditRecord.php b/src/Resources/Pages/EditRecord.php
index 1c22c2adf0..b79df91c43 100644
--- a/src/Resources/Pages/EditRecord.php
+++ b/src/Resources/Pages/EditRecord.php
@@ -68,6 +68,8 @@ class EditRecord extends Page
     public function mount($record)
     {
         $this->fillRecord($record);
+
+        $this->abortIfForbidden();
     }
 
     public function save()
@@ -102,21 +104,28 @@ class EditRecord extends Page
         ];
     }
 
-    protected function fillRecord($record)
+    protected function fillRecord($key)
     {
         $this->callHook('beforeFill');
 
-        $model = static::getModel();
-
-        $this->record = (new $model())->resolveRouteBinding($record);
-
-        if ($this->record === null) {
-            throw (new ModelNotFoundException())->setModel($model, [$record]);
-        }
+        $this->record = $this->resolveRecord($key);
 
         $this->callHook('afterFill');
     }
 
+    protected function resolveRecord($key)
+    {
+        $model = static::getModel();
+
+        $record = (new $model())->resolveRouteBinding($key);
+
+        if ($record === null) {
+            throw (new ModelNotFoundException())->setModel($model, [$key]);
+        }
+
+        return $record;
+    }
+
     protected function form(Form $form)
     {
         return static::getResource()::form(
diff --git a/src/Resources/Pages/ListRecords.php b/src/Resources/Pages/ListRecords.php
index 900ceeee9e..f08e5eee5a 100644
--- a/src/Resources/Pages/ListRecords.php
+++ b/src/Resources/Pages/ListRecords.php
@@ -107,4 +107,9 @@ class ListRecords extends Page
             'records' => $this->getRecords(),
         ];
     }
+
+    public function mount()
+    {
+        $this->abortIfForbidden();
+    }
 }
diff --git a/src/Resources/RelationManager/EditRecord.php b/src/Resources/RelationManager/EditRecord.php
index 9048dfdafc..6bc34a7007 100644
--- a/src/Resources/RelationManager/EditRecord.php
+++ b/src/Resources/RelationManager/EditRecord.php
@@ -85,7 +85,7 @@ class EditRecord extends Component
         $this->record = [];
     }
 
-    public function switchRecord($manager, $record)
+    public function switchRecord($manager, $recordKey)
     {
         if ($manager !== $this->manager) {
             return;
@@ -93,7 +93,7 @@ class EditRecord extends Component
 
         $this->callHook('beforeFill');
 
-        $this->record = $this->getQuery()->find($record);
+        $this->record = $this->getQuery()->find($recordKey);
         $this->resetTemporaryUploadedFiles();
 
         $this->callHook('afterFill');