From fb7f291f31507302c32f72a0025f89349917c494 Mon Sep 17 00:00:00 2001 From: Josef Citrine Date: Tue, 17 May 2016 13:00:57 +0100 Subject: [PATCH] Switch admin check to Gate --- app/Commands/SaveAccountSettingsCommand.php | 64 +++++++++++-------- .../Controllers/Api/Web/AccountController.php | 25 ++++---- app/Http/routes.php | 2 - 3 files changed, 53 insertions(+), 38 deletions(-) diff --git a/app/Commands/SaveAccountSettingsCommand.php b/app/Commands/SaveAccountSettingsCommand.php index 23f1af78..6531e7dc 100644 --- a/app/Commands/SaveAccountSettingsCommand.php +++ b/app/Commands/SaveAccountSettingsCommand.php @@ -22,6 +22,7 @@ namespace Poniverse\Ponyfm\Commands; use Poniverse\Ponyfm\Models\Image; use Poniverse\Ponyfm\Models\User; +use Gate; use Illuminate\Support\Facades\Auth; use Illuminate\Support\Facades\Validator; @@ -29,11 +30,15 @@ class SaveAccountSettingsCommand extends CommandBase { private $_input; private $_slug; + private $_user; + private $_current; function __construct($input, $slug) { $this->_input = $input; $this->_slug = $slug; + $this->_user = null; + $this->_current = null; } /** @@ -41,7 +46,25 @@ class SaveAccountSettingsCommand extends CommandBase */ public function authorize() { - return Auth::user() != null || Auth::user()->hasRole('admin'); + if (Auth::user() != null) { + $this->_current = Auth::user(); + + if ($this->_slug == $this->_current->slug) { + $this->_user = $this->_current; + } else { + $this->_user = User::where('slug', $this->_slug)->whereNull('disabled_at')->first(); + } + + if ($this->_user == null) { + return false; + } + + if (Gate::allows('edit', $this->_user)) { + return true; + } + } + + return false; } /** @@ -50,17 +73,8 @@ class SaveAccountSettingsCommand extends CommandBase */ public function execute() { - $user = null; - $current_user = Auth::user(); - - if ($this->_slug == -1 || $this->_slug == $current_user->slug) { - $user = $current_user; - } else if ($current_user->hasRole('admin')) { - $user = User::where('slug', $this->_slug)->whereNull('disabled_at')->first(); - } - - if ($user == null) { - if ($current_user->hasRole('admin')) { + if ($this->_user == null) { + if ($_current->hasRole('admin')) { return CommandResponse::fail(['Not found']); } else { return CommandResponse::fail(['Permission denied']); @@ -73,7 +87,7 @@ class SaveAccountSettingsCommand extends CommandBase ]; if ($this->_input['sync_names'] == 'true') { - $this->_input['display_name'] = $user->username; + $this->_input['display_name'] = $this->_user->username; } if ($this->_input['uses_gravatar'] == 'true') { @@ -90,7 +104,7 @@ class SaveAccountSettingsCommand extends CommandBase } if ($this->_input['uses_gravatar'] != 'true') { - if ($user->avatar_id == null && !isset($this->_input['avatar']) && !isset($this->_input['avatar_id'])) { + if ($this->_user->avatar_id == null && !isset($this->_input['avatar']) && !isset($this->_input['avatar_id'])) { $validator->messages()->add('avatar', 'You must upload or select an avatar if you are not using gravatar!'); @@ -98,26 +112,26 @@ class SaveAccountSettingsCommand extends CommandBase } } - $user->bio = $this->_input['bio']; - $user->display_name = $this->_input['display_name']; - $user->sync_names = $this->_input['sync_names'] == 'true'; - $user->can_see_explicit_content = $this->_input['can_see_explicit_content'] == 'true'; - $user->uses_gravatar = $this->_input['uses_gravatar'] == 'true'; + $this->_user->bio = $this->_input['bio']; + $this->_user->display_name = $this->_input['display_name']; + $this->_user->sync_names = $this->_input['sync_names'] == 'true'; + $this->_user->can_see_explicit_content = $this->_input['can_see_explicit_content'] == 'true'; + $this->_user->uses_gravatar = $this->_input['uses_gravatar'] == 'true'; - if ($user->uses_gravatar) { - $user->avatar_id = null; - $user->gravatar = $this->_input['gravatar']; + if ($this->_user->uses_gravatar) { + $this->_user->avatar_id = null; + $this->_user->gravatar = $this->_input['gravatar']; } else { if (isset($this->_input['avatar_id'])) { - $user->avatar_id = $this->_input['avatar_id']; + $this->_user->avatar_id = $this->_input['avatar_id']; } else { if (isset($this->_input['avatar'])) { - $user->avatar_id = Image::upload($this->_input['avatar'], $user)->id; + $this->_user->avatar_id = Image::upload($this->_input['avatar'], $this->_user)->id; } } } - $user->save(); + $this->_user->save(); return CommandResponse::succeed(); } diff --git a/app/Http/Controllers/Api/Web/AccountController.php b/app/Http/Controllers/Api/Web/AccountController.php index 7dd0bd7f..051283d5 100644 --- a/app/Http/Controllers/Api/Web/AccountController.php +++ b/app/Http/Controllers/Api/Web/AccountController.php @@ -24,27 +24,30 @@ use Poniverse\Ponyfm\Http\Controllers\ApiControllerBase; use Poniverse\Ponyfm\Commands\SaveAccountSettingsCommand; use Poniverse\Ponyfm\Models\User; use Cover; +use Gate; use Illuminate\Support\Facades\Auth; use Illuminate\Support\Facades\Input; use Illuminate\Support\Facades\Response; class AccountController extends ApiControllerBase { - public function getSettings($slug = -1) + public function getSettings($slug) { $user = null; $current_user = Auth::user(); - if ($slug == -1 || $slug == $current_user->slug) { - $user = $current_user; - } else if ($current_user->hasRole('admin')) { - $user = User::where('slug', $slug)->whereNull('disabled_at')->first(); - } - - if ($user == null) { - if ($current_user->hasRole('admin')) { - return Response::json(['error' => 'User does not exist'], 404); + if ($current_user != null) { + if ($slug == $current_user->slug) { + $user = $current_user; } else { + $user = User::where('slug', $slug)->whereNull('disabled_at')->first(); + } + + if ($user == null) { + return Response::json(['error' => 'User does not exist'], 404); + } + + if (Gate::denies('edit', $user)) { return Response::json(['error' => 'You cannot do that. So stop trying!'], 403); } } @@ -63,7 +66,7 @@ class AccountController extends ApiControllerBase ], 200); } - public function postSave($slug = -1) + public function postSave($slug) { return $this->execute(new SaveAccountSettingsCommand(Input::all(), $slug)); } diff --git a/app/Http/routes.php b/app/Http/routes.php index ba83079f..7e9a47cd 100644 --- a/app/Http/routes.php +++ b/app/Http/routes.php @@ -123,7 +123,6 @@ Route::group(['prefix' => 'api/web'], function() { Route::post('/comments/{type}/{id}', 'Api\Web\CommentsController@postCreate')->where('id', '\d+'); - Route::post('/account/settings/save', 'Api\Web\AccountController@postSave'); Route::post('/account/settings/save/{slug}', 'Api\Web\AccountController@postSave'); Route::post('/favourites/toggle', 'Api\Web\FavouritesController@postToggle'); @@ -134,7 +133,6 @@ Route::group(['prefix' => 'api/web'], function() { }); Route::group(['middleware' => 'auth'], function() { - Route::get('/account/settings', 'Api\Web\AccountController@getSettings'); Route::get('/account/settings/{slug}', 'Api\Web\AccountController@getSettings'); Route::get('/tracks/owned', 'Api\Web\TracksController@getOwned');