mirrors/thebadspace
1
0
Fork 0
mirror of https://koodu.h-i.works/projects/thebadspace synced 2025-06-25 16:04:37 -05:00
Code Packages Releases Activity

add role checks for admin function

Browse Source 
admin functions are not shown to member with incorrect roles, but added
a bit more padding in the controller itself to check if the role is
correct before running an admin action for a little extra security
This commit is contained in:
ro
2024-09-29 15:55:55 -06:00
parent 3c0762344e
commit 31f45c4af5
2 changed files with 67 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
app/Http/Controllers/MemberController.php
View File

@ -72,34 +72,51 @@ class MemberController extends Controller
//actions
public function profileEdit(Request $request)
{
$token = csrf_token();
$response = $this->member->editProfile($request);
if ($response['status'] == true) {
return back()->with('message', $response['message']);
$token = csrf_token();
//check if logged in member id matches profile request id
$member = Auth::user();
if ($member->uuid == $request->id) {
$response = $this->member->editProfile($request);
if ($response['status'] == true) {
return back()->with('message', $response['message']);
} else {
return back()->withErrors([$response['message']]);
}
} else {
return back()->withErrors([$response['message']]);
return back()->withErrors(['This is not your profile to edit.']);
}
}
public function memberEdit(Request $request)
{
$token = csrf_token();
$response = $this->member->edit($request);
if ($response['status'] == true) {
return back()->with('message', $response['message']);
$token = csrf_token();
//role check
$member = Auth::user();
if ($member->role == 0 || $member->role == 1) {
$response = $this->member->edit($request);
if ($response['status'] == true) {
return back()->with('message', $response['message']);
} else {
return back()->withErrors([$response['message']]);
}
} else {
return back()->withErrors([$response['message']]);
return back()->withErrors(['Nah, you can\'t do this. Wrong permissions.']);
}
}
public function memberCreate(Request $request)
{
$token = csrf_token();
$response = $this->member->add($request);
if ($response['status'] == true) {
return redirect('/den/member')->with('message', $response['message']);
$token = csrf_token();
$member = Auth::user();
if ($member->role == 0 || $member->role == 1) {
$response = $this->member->add($request);
if ($response['status'] == true) {
return redirect('/den/member')->with('message', $response['message']);
} else {
return back()->withErrors([$response['message']]);
}
} else {
return back()->withErrors([$response['message']]);
return back()->withErrors(['Nah, you can\'t do this. Wrong permissions.']);
}
}
}