FEATURE: allow user edit only for admin

app/Http/Controllers/Admin/EditUser.php

@@ -44,8 +44,17 @@ class EditUser extends Controller
      */
     public function postEdit(EditUserRequest $request, $id)
     {
+        $loggedUser = Auth::user();
+
         $user = User::findOrFail($id);
 
+        // non-admin user is trying to edit someone else
+        if ($loggedUser->role != User::ROLE_ADMIN && $id != $loggedUser->id) {
+            return redirect()
+                ->back()
+                ->with('error', trans('auth.accessDenied'));
+        }
+
         // update username if set
         if (isset($request->username)) {
             $user->username = $request->username;
@@ -56,7 +65,6 @@ class EditUser extends Controller
             $user->name = $request->name;
         }
 
-        if (Auth::user()->role == User::ROLE_ADMIN) {
         if (isset($request->role)) {
             $user->role = $request->role;
         }
@@ -68,7 +76,6 @@ class EditUser extends Controller
         if (isset($request->password)) {
             $user->password = Hash::make($request->password);
         }
-        }
 
         $user->email = $request->email;
 

resources/views/admin/userManagement/editForm.blade.php

@@ -18,14 +18,13 @@
         @endif
     </label>
 
-    @if (\Auth::user()->role == \App\Models\User::ROLE_ADMIN)
-
     <label>
         @lang('admin/userManagement.password') <em>(@lang('admin/userManagement.passwordLeaveEmpty'))</em>
 
         <input type="text" name="password" value="">
     </label>
 
+    @if (\Auth::user()->role == \App\Models\User::ROLE_ADMIN)
         <label>
             @lang('admin/userManagement.roles')