Fixed #5938 - added “self location edit” as permission

app/Http/Controllers/ProfileController.php

@@ -45,15 +45,21 @@ class ProfileController extends Controller
     {
 
         $user = Auth::user();
-        $user->first_name = Input::get('first_name');
+        $user->first_name = $request->input('first_name');
-        $user->last_name  = Input::get('last_name');
+        $user->last_name  = $request->input('last_name');
-        $user->website    = Input::get('website');
+        $user->website    = $request->input('website');
-        $user->location_id    = Input::get('location_id');
+        $user->gravatar   = $request->input('gravatar');
-        $user->gravatar   = Input::get('gravatar');
+
-        $user->locale = Input::get('locale');
+        if (!config('app.lock_passwords')) {
+            $user->locale = $request->input('locale', 'en');
+        }
 
         if ((Gate::allows('self.two_factor')) && ((Setting::getSettings()->two_factor_enabled=='1') && (!config('app.lock_passwords')))) {
-            $user->two_factor_optin = Input::get('two_factor_optin', '0');
+            $user->two_factor_optin = $request->input('two_factor_optin', '0');
+        }
+
+        if (Gate::allows('self.edit_location')  && (!config('app.lock_passwords'))) {
+            $user->location_id    = $request->input('location_id');
         }
         
         if (Input::file('avatar')) {

app/Http/Controllers/SettingsController.php

@@ -169,7 +169,11 @@ class SettingsController extends Controller
         $settings->alerts_enabled = 1;
         $settings->pwd_secure_min = 10;
         $settings->brand = 1;
-        $settings->locale = $request->input('locale', 'en');
+
+        if (!config('app.lock_passwords')) {
+            $settings->locale = $request->input('locale', 'en');
+        }
+
         $settings->default_currency = $request->input('default_currency', "USD");
         $settings->user_id = 1;
         $settings->email_domain = $request->input('email_domain');

app/Providers/AuthServiceProvider.php

@@ -135,6 +135,10 @@ class AuthServiceProvider extends ServiceProvider
             return $user->hasAccess('self.api');
         });
 
+        Gate::define('self.edit_location', function($user) {
+            return $user->hasAccess('self.edit_location');
+        });
+
         Gate::define('backend.interact', function ($user) {
             return $user->can('view', Statuslabel::class)
                 || $user->can('view', AssetModel::class)

config/permissions.php

@@ -571,6 +571,13 @@ return array(
             'display'    => true,
         ),
 
+        array(
+            'permission' => 'self.edit_location',
+            'label'      => 'Profile Edit Location',
+            'note'       => 'The user may update their own location in their profile. Note that this is not affected by any additional Users permissions you grant to this user or group.',
+            'display'    => true,
+        ),
+
     ),
 
 

resources/views/account/profile.blade.php

@@ -37,19 +37,29 @@
         </div>
 
 
+        @can('self.edit_location')
         <!-- Location -->
         @include ('partials.forms.edit.location-profile-select', ['translated_name' => trans('general.location')])
+        @endcan
+
 
         <!-- Language -->
         <div class="form-group {{ $errors->has('locale') ? 'has-error' : '' }}">
           <label class="col-md-3 control-label" for="locale">{{ trans('general.language') }}</label>
           <div class="col-md-9">
-            {!! Form::locales('locale', Input::old('locale', $user->locale), 'select2') !!}
+
-            {!! $errors->first('locale', '<span class="alert-msg">:message</span>') !!}
+            @if (!config('app.lock_passwords'))
+              {!! Form::locales('locale', Input::old('locale', $user->locale), 'select2') !!}
+              {!! $errors->first('locale', '<span class="alert-msg">:message</span>') !!}
+            @else
+              <p class="help-block">{{ trans('general.feature_disabled') }}</p>
+            @endif
+
           </div>
         </div>
 
 
+
         <!-- Website URL -->
         <div class="form-group {{ $errors->has('website') ? ' has-error' : '' }}">
           <label for="website" class="col-md-3 control-label">{{ trans('general.website') }}</label>