diff --git a/app/Http/Controllers/BanController.php b/app/Http/Controllers/BanController.php index cfc8443..bd46424 100644 --- a/app/Http/Controllers/BanController.php +++ b/app/Http/Controllers/BanController.php @@ -15,7 +15,7 @@ class BanController extends Controller public function insert(BanUserRequest $request, User $user) { - $this->authorize('create', Ban::class); + $this->authorize('create', [Ban::class, $user]); if (is_null($user->bans)) { diff --git a/app/Policies/BanPolicy.php b/app/Policies/BanPolicy.php index 12b893e..979bb52 100644 --- a/app/Policies/BanPolicy.php +++ b/app/Policies/BanPolicy.php @@ -41,15 +41,16 @@ class BanPolicy * @param \App\User $user * @return mixed */ - public function create(User $user) + public function create(User $user, User $targetUser) { Log::debug("Authorization check started", [ 'requiredRoles' => 'admin', - 'currentRoles' => $user->roles(), + 'currentRoles' => $user->roles, 'hasRequiredRole' => $user->hasRole('admin'), + 'targetUser' => $user->username, 'isCurrentUser' => Auth::user()->is($user) ]); - return $user->hasRole('admin') && Auth::user()->isNot($user); + return $user->hasRole('admin') && $user->isNot($targetUser); } /**