diff --git a/dist/app/Http/Controllers/Web/Admin/Tools/UsersController.php b/dist/app/Http/Controllers/Web/Admin/Tools/UsersController.php index 3164801..bb335c4 100644 --- a/dist/app/Http/Controllers/Web/Admin/Tools/UsersController.php +++ b/dist/app/Http/Controllers/Web/Admin/Tools/UsersController.php @@ -26,6 +26,9 @@ class UsersController extends AdminToolController public function index(Request $request) { + if(!Auth::user()->can(Permissions::VIEW_USERS->value)) + abort(403, 'No Permission to view this Page'); + $searchString = $request->input('search'); $query = User::orderBy('last_known_username'); @@ -42,6 +45,9 @@ public function index(Request $request) public function details(User $user) { + if(!Auth::user()->can(Permissions::VIEW_USERS->value)) + abort(403, 'No Permission to view this Page'); + View::share('title', 'User Details: '.$user->last_known_username); return view('admin.tools.user-details', [ @@ -83,7 +89,7 @@ public function reset(User $user) $canReset = Auth::check() && Auth::user()->can(Permissions::EDIT_USERS->value); if(!$canReset) - return response('You dont have the Permission for this.', 403); + abort(403, 'You dont have enough permissions for this action.'); $user->playerData()->delete(); return redirect()->back(); diff --git a/dist/resources/views/admin/tools/user-details.blade.php b/dist/resources/views/admin/tools/user-details.blade.php index b6bd313..126e023 100644 --- a/dist/resources/views/admin/tools/user-details.blade.php +++ b/dist/resources/views/admin/tools/user-details.blade.php @@ -14,13 +14,15 @@ use App\Enums\Game\Hunter; use App\Models\User\PlayerData; - $allowEdit = $user->can(\App\Enums\Auth\Permissions::EDIT_USERS->value); + $allowEdit = \Illuminate\Support\Facades\Auth::user()->can(\App\Enums\Auth\Permissions::EDIT_USERS->value); @endphp
@if($allowEdit) -
@csrf @endif + + @csrf + @endif

General Info