Leahnaya/Deathgarden_Rebirth-Rewrite
1
0
Fork 0
mirror of https://github.com/Deathgarden-Rebirth/Deathgarden_Rebirth-Rewrite.git synced 2026-09-09 03:35:14 -05:00
Code Issues Actions Packages Projects Releases Wiki Activity

Created a middleware for checking permissions in admin controllers, so I cannot forget to add permission checks.

Browse Source 
Changed some descriptions of the admin tools for Miraak.

Aded some more Permissions and added a moderator role.
This commit is contained in:
Vari
2024-08-11 16:34:59 +02:00
parent a07e7710d0
commit a0e2e321cc
15 changed files with 107 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
dist/app/Http/Controllers/Web/Admin/Tools/UsersController.php vendored
View File

@@ -3,6 +3,7 @@
namespace App\Http\Controllers\Web\Admin\Tools;
use App\APIClients\HttpMethod;
use App\Attributes\IgnorePermissionCheck;
use App\Enums\Auth\Permissions;
use App\Enums\Game\Characters;
use App\Enums\Game\Runner;
@@ -24,7 +25,7 @@ class UsersController extends AdminToolController
{
protected static string $name = 'Users';
protected static string $description = 'View and Manage Users';
protected static string $description = 'View & Manage Users';
protected static string $iconComponent = 'icons.users';
@@ -36,9 +37,6 @@ class UsersController extends AdminToolController
public function index(Request $request)
{
if(!Auth::user()->can(Permissions::VIEW_USERS->value))
abort(403, 'No Permission to view this Page');
$searchString = $request->input('search');
$query = User::orderBy('last_known_username');
@@ -67,6 +65,9 @@ public function details(User $user)
public function edit(User $user, EditUserRequest $request)
{
if(!Auth::user()->can(Permissions::EDIT_USERS->value))
abort(403);
$playerData = $user->playerData();
$playerData->currency_a = $request->currencyA;
@@ -94,10 +95,12 @@ public function edit(User $user, EditUserRequest $request)
return redirect()->back();
}
#[IgnorePermissionCheck]
public function getUsersForDropdown(Request $request)
{
if(!Auth::check() && Auth::user()->can(Permissions::VIEW_USERS->value))
abort(403, 'No Permission to get this Data');
// only allow the retrieval of the dropdown if we have the view users permission or inbox mailer because there we need it.
if(!Auth::check() || !(Auth::user()->can(Permissions::VIEW_USERS->value) || Auth::user()->can(Permissions::INBOX_MAILER->value)))
abort(403);
$searchTerm = $request->input('term');
@@ -131,10 +134,8 @@ public function getUsersForDropdown(Request $request)
public function reset(User $user)
{
$canReset = Auth::check() && Auth::user()->can(Permissions::EDIT_USERS->value);
if(!$canReset)
abort(403, 'You dont have enough permissions for this action.');
if(!Auth::user()->can(Permissions::EDIT_USERS->value))
abort(403);
$user->playerData()->delete();
return redirect()->back();
@@ -142,8 +143,8 @@ public function reset(User $user)
public function bans(User $user)
{
if(!Auth::user()->can(Permissions::EDIT_USERS->value))
abort(403, 'You are not allowed to edit Bans of a User.');
if(!Auth::user()->can(Permissions::USER_BANS->value))
abort(403);
$bans = $user->bans;
$this->overrideTitle('Bans for User: '.$user->id.'('.$user->last_known_username.')');
@@ -172,8 +173,8 @@ public function banPost(User $user, Ban $ban, BanPostRequest $request) {
}
public function createBan(User $user) {
if(!Auth::user()->can(Permissions::EDIT_USERS->value))
abort(403, 'No Permission to create a Ban.');
if(!Auth::user()->can(Permissions::USER_BANS->value))
abort(403);
$newBan = new Ban();
$newBan->ban_reason = 'Placeholder';