DRCIT/snipe-it
1
0
Fork 0
mirror of https://github.com/snipe/snipe-it.git synced 2024-12-24 05:04:07 -08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

Prevent editing special users demo mode

Browse source
This commit is contained in:
snipe 2019-02-04 19:13:55 -08:00
parent 59cb1e561e
commit 4fd469e07b
2 changed files with 17 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
app/Http/Controllers/Api/UsersController.php
View file

@ -242,6 +242,16 @@ class UsersController extends Controller
$this->authorize('update', User::class); $this->authorize('update', User::class);
$user = User::findOrFail($id); $user = User::findOrFail($id);
// This is a janky hack to prevent people from changing admin demo user data on the public demo.
// The $ids 1 and 2 are special since they are seeded as superadmins in the demo seeder.
// Thanks, jerks. You are why we can't have nice things. - snipe
if ((($id == 1) || ($id == 2)) && (config('app.lock_passwords'))) {
return response()->json(Helper::formatStandardApiResponse('error', null, 'Permission denied. You cannot update user information via API on the demo.'));
}
$user->fill($request->all()); $user->fill($request->all());
if ($user->id == $request->input('manager_id')) { if ($user->id == $request->input('manager_id')) {

10
app/Http/Controllers/Users/UsersController.php
View file

@ -224,9 +224,13 @@ class UsersController extends Controller
// permissions here before we update the user. // permissions here before we update the user.
$permissions = $request->input('permissions', array()); $permissions = $request->input('permissions', array());
app('request')->request->set('permissions', $permissions); app('request')->request->set('permissions', $permissions);
// Only update the email address if locking is set to false
if (config('app.lock_passwords')) { // This is a janky hack to prevent people from changing admin demo user data on the public demo.
return redirect()->route('users.index')->with('error', 'Denied! You cannot update user information on the demo.'); // The $ids 1 and 2 are special since they are seeded as superadmins in the demo seeder.
// Thanks, jerks. You are why we can't have nice things. - snipe
if ((($id == 1) || ($id == 2)) && (config('app.lock_passwords'))) {
return redirect()->route('users.index')->with('error', 'Permission denied. You cannot update user information for superadmins on the demo.');
} }
try { try {