forked from miguel456/rbrecruiter
Code review
This commit fixes some superficial instances of Broken Access Control (https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/Top_10-2017_A5-Broken_Access_Control). There may be some more instances of this, as authorization was only done after most of the controllers were done (big mistake). Some refactoring was also performed, where Route Model Binding with DI (dependency injection) was used whenever possible, to increase testability of the codebase. Some reused code was also moved to Helper classes as to enforce DRY; There may be some lines of code that are still copy-pasted from other parts of the codebase for reuse. Non-breaking refactoring changes were made, but the app as a whole still needs full manual testing, and customised responses to HTTP 500 responses. Some errors are also not handled gracefully and this wasn't checked in this commit.
This commit is contained in:
@@ -87,7 +87,6 @@ class ProfileController extends Controller
|
||||
|
||||
public function saveProfile(ProfileSave $request)
|
||||
{
|
||||
// TODO: Switch to route model binding
|
||||
$profile = User::find(Auth::user()->id)->profile;
|
||||
$social = [];
|
||||
|
||||
@@ -120,19 +119,6 @@ class ProfileController extends Controller
|
||||
$request->session()->flash('success', 'Profile settings saved successfully.');
|
||||
|
||||
}
|
||||
else
|
||||
{
|
||||
$gm = 'Guru Meditation #' . rand(0, 1000);
|
||||
Log::alert('[GURU MEDITATION]: Could not find profile for authenticated user ' . Auth::user()->name . 'whilst trying to update it! Please verify that profiles are being created automatically during signup.',
|
||||
[
|
||||
'uuid' => Auth::user()->uuid,
|
||||
'timestamp' => now(),
|
||||
'route' => $request->route()->getName(),
|
||||
'gmcode' => $gm // If this error is reported, the GM code, denoting a severe error, will help us find this entry in the logs
|
||||
|
||||
]);
|
||||
$request->session()->flash('error', 'A technical error has occurred whilst trying to save your profile. Incident details have been recorded. Please report this incident to administrators with the following case number: ' . $gm);
|
||||
}
|
||||
|
||||
return redirect()->back();
|
||||
|
||||
|
Reference in New Issue
Block a user