From 551e1af5fe32911aa104b9b26ac3e9b0de870f3c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20Kv=C3=A1=C4=8Dek?= <michal@binarity.cz>
Date: Fri, 22 Jan 2016 12:46:18 +0100
Subject: [PATCH] FIX: fix some security issue

---
 app/Http/Middleware/Authenticate.php | 6 +++---
 app/Http/Requests/CreateNewUser.php  | 3 ++-
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/app/Http/Middleware/Authenticate.php b/app/Http/Middleware/Authenticate.php
index fb6411f6..074f8f9d 100644
--- a/app/Http/Middleware/Authenticate.php
+++ b/app/Http/Middleware/Authenticate.php
@@ -17,12 +17,12 @@ class Authenticate
      */
     public function handle($request, Closure $next, $guard = null)
     {
-        if (Auth::check()) {
+        if (!Auth::check($guard)) {
             if ($request->ajax()) {
                 return response('Unauthorized.', 401);
-            } else {
-                return redirect()->guest('login');
             }
+
+            return redirect()->guest('login');
         }
 
         return $next($request);
diff --git a/app/Http/Requests/CreateNewUser.php b/app/Http/Requests/CreateNewUser.php
index 8295ddc3..adec8c26 100644
--- a/app/Http/Requests/CreateNewUser.php
+++ b/app/Http/Requests/CreateNewUser.php
@@ -14,7 +14,8 @@ class CreateNewUser extends Request
      */
     public function authorize()
     {
-        return \Auth::$user->role == User::ROLE_ADMIN;
+
+        return \Auth::check() && \Auth::$user->role == User::ROLE_ADMIN;
     }
 
     /**