FEATURE: allow user edit only for admin

app/Http/Controllers/Admin/EditUser.php

@@ -44,8 +44,17 @@ class EditUser extends Controller
      */
     public function postEdit(EditUserRequest $request, $id)
     {
+        $loggedUser = Auth::user();
+
         $user = User::findOrFail($id);
 
+        // non-admin user is trying to edit someone else
+        if ($loggedUser->role != User::ROLE_ADMIN && $id != $loggedUser->id) {
+            return redirect()
+                ->back()
+                ->with('error', trans('auth.accessDenied'));
+        }
+
         // update username if set
         if (isset($request->username)) {
             $user->username = $request->username;
@@ -56,18 +65,16 @@ class EditUser extends Controller
             $user->name = $request->name;
         }
 
-        if (Auth::user()->role == User::ROLE_ADMIN) {
-            if (isset($request->role)) {
-                $user->role = $request->role;
-            }
+        if (isset($request->role)) {
+            $user->role = $request->role;
+        }
 
-            if (isset($request->status)) {
-                $user->status = $request->status;
-            }
+        if (isset($request->status)) {
+            $user->status = $request->status;
+        }
 
-            if (isset($request->password)) {
-                $user->password = Hash::make($request->password);
-            }
+        if (isset($request->password)) {
+            $user->password = Hash::make($request->password);
         }
 
         $user->email = $request->email;

resources/views/admin/userManagement/editForm.blade.php

@@ -18,14 +18,13 @@
         @endif
     </label>
 
+    <label>
+        @lang('admin/userManagement.password') <em>(@lang('admin/userManagement.passwordLeaveEmpty'))</em>
+
+        <input type="text" name="password" value="">
+    </label>
+
     @if (\Auth::user()->role == \App\Models\User::ROLE_ADMIN)
-
-        <label>
-            @lang('admin/userManagement.password') <em>(@lang('admin/userManagement.passwordLeaveEmpty'))</em>
-
-            <input type="text" name="password" value="">
-        </label>
-
         <label>
             @lang('admin/userManagement.roles')