minicms/core
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

FEATURE: allow user edit only for admin

Browse Source
This commit is contained in:
Michal Kváček
2016-01-29 12:26:39 +01:00
parent 527b482ab8
commit f262be1dcb
2 changed files with 23 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Http/Controllers/Admin/EditUser.php
+17 -10
View File
@@ -44,8 +44,17 @@ class EditUser extends Controller
*/
public function postEdit(EditUserRequest $request, $id)
{
$loggedUser = Auth::user();
$user = User::findOrFail($id);
// non-admin user is trying to edit someone else
if ($loggedUser->role != User::ROLE_ADMIN && $id != $loggedUser->id) {
return redirect()
->back()
->with('error', trans('auth.accessDenied'));
}
// update username if set
if (isset($request->username)) {
$user->username = $request->username;
@@ -56,18 +65,16 @@ class EditUser extends Controller
$user->name = $request->name;
}
if (Auth::user()->role == User::ROLE_ADMIN) {
if (isset($request->role)) {
$user->role = $request->role;
}
if (isset($request->role)) {
$user->role = $request->role;
}
if (isset($request->status)) {
$user->status = $request->status;
}
if (isset($request->status)) {
$user->status = $request->status;
}
if (isset($request->password)) {
$user->password = Hash::make($request->password);
}
if (isset($request->password)) {
$user->password = Hash::make($request->password);
}
$user->email = $request->email;