From f262be1dcb251e99c2dc916c1af29124c4bb3214 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michal=20Kv=C3=A1=C4=8Dek?= <michal@binarity.cz>
Date: Fri, 29 Jan 2016 12:26:39 +0100
Subject: [PATCH] FEATURE: allow user edit only for admin

---
 app/Http/Controllers/Admin/EditUser.php       | 27 ++++++++++++-------
 .../admin/userManagement/editForm.blade.php   | 13 +++++----
 2 files changed, 23 insertions(+), 17 deletions(-)

diff --git a/app/Http/Controllers/Admin/EditUser.php b/app/Http/Controllers/Admin/EditUser.php
index f9b0a7c5..9acb5450 100644
--- a/app/Http/Controllers/Admin/EditUser.php
+++ b/app/Http/Controllers/Admin/EditUser.php
@@ -44,8 +44,17 @@ class EditUser extends Controller
      */
     public function postEdit(EditUserRequest $request, $id)
     {
+        $loggedUser = Auth::user();
+
         $user = User::findOrFail($id);
 
+        // non-admin user is trying to edit someone else
+        if ($loggedUser->role != User::ROLE_ADMIN && $id != $loggedUser->id) {
+            return redirect()
+                ->back()
+                ->with('error', trans('auth.accessDenied'));
+        }
+
         // update username if set
         if (isset($request->username)) {
             $user->username = $request->username;
@@ -56,18 +65,16 @@ class EditUser extends Controller
             $user->name = $request->name;
         }
 
-        if (Auth::user()->role == User::ROLE_ADMIN) {
-            if (isset($request->role)) {
-                $user->role = $request->role;
-            }
+        if (isset($request->role)) {
+            $user->role = $request->role;
+        }
 
-            if (isset($request->status)) {
-                $user->status = $request->status;
-            }
+        if (isset($request->status)) {
+            $user->status = $request->status;
+        }
 
-            if (isset($request->password)) {
-                $user->password = Hash::make($request->password);
-            }
+        if (isset($request->password)) {
+            $user->password = Hash::make($request->password);
         }
 
         $user->email = $request->email;
diff --git a/resources/views/admin/userManagement/editForm.blade.php b/resources/views/admin/userManagement/editForm.blade.php
index 4f4302db..3a057cf1 100644
--- a/resources/views/admin/userManagement/editForm.blade.php
+++ b/resources/views/admin/userManagement/editForm.blade.php
@@ -18,14 +18,13 @@
         @endif
     </label>
 
+    <label>
+        @lang('admin/userManagement.password') <em>(@lang('admin/userManagement.passwordLeaveEmpty'))</em>
+
+        <input type="text" name="password" value="">
+    </label>
+
     @if (\Auth::user()->role == \App\Models\User::ROLE_ADMIN)
-
-        <label>
-            @lang('admin/userManagement.password') <em>(@lang('admin/userManagement.passwordLeaveEmpty'))</em>
-
-            <input type="text" name="password" value="">
-        </label>
-
         <label>
             @lang('admin/userManagement.roles')