I'm learning Laravel 5. I have finished the document's Quickstart - intermediate. I want to apply the authorize check for Task's actions to the User's. I want to check whether the target user is the current logged in user in order to use user's edit action. However, browser keeps telling me when I try to access http://ift.tt/2a4FK9F:
HttpException in Handler.php line 107:
This action is unauthorized.
I put a check whether target user and current user are the same(via id) right before calling $this->authorize('edit', $user); and it passes the condition. But $this->authorize('edit', $user); still denies. How can I fix this?
Routes.php
Route::get('/users/{user}', 'UsersController@view');
Route::get('/users/{user}/edit', 'UsersController@edit');
Route::patch('/users/{user}', 'UsersController@update');
AuthServiceProvider.php
protected $policies = [
'App\Model' => 'App\Policies\ModelPolicy',
'App\Task' => 'App\Policies\TaskPolicy',
'App\Users' => 'App\Policies\UsersPolicy',
];
UsersPolicy.php
namespace App\Policies;
use App\User;
use Illuminate\Http\Request;
use Illuminate\Auth\Access\HandlesAuthorization;
class UsersPolicy
{
use HandlesAuthorization;
public function edit(Request $request, User $user)
{
return $request->user()->id === $user->id;
}
public function update(Request $request, User $user)
{
return $request->user()->id === $user->id;
}
}
UsersController.php
namespace App\Http\Controllers;
use App\User;
use Illuminate\Http\Request;
use App\Http\Controllers\Controller;
class UsersController extends Controller
{
protected $user;
public function __construct() {
$this->middleware('auth');
}
public function view(Request $request, User $user)
{
if($request->user()->id == $user->id){
return view('users.view', ['user' => $user]);
}
return redirect('/tasks');
}
public function edit(Request $request, User $user)
{
//My check
if($request->user()->id === $user->id){
$this->authorize('edit', $user);
return view('users.edit', compact('user'));
}else{
return redirect('/users/'.$user->id);
}
}
public function update(Request $request, User $user)
{
$this->authorize('update', $user);
$user->update($request->all());
return redirect('/users/'.$user->id);
}
}
from Newest questions tagged laravel-5 - Stack Overflow http://ift.tt/2aa4Loj
via IFTTT
Aucun commentaire:
Enregistrer un commentaire