From 70e6a6ced6d590594275f7d365bfd861c6d2432d Mon Sep 17 00:00:00 2001 From: Brady Wetherington Date: Wed, 27 Jan 2021 15:36:43 -0800 Subject: [PATCH] Fix issue where users with edit permission cannot invoke LDAP sync (#9058) * Fix issue where users with edit permission cannot invoke LDAP sync * Make User::class consistent with usage elsewhere in the same directory --- app/Http/Controllers/Users/LDAPImportController.php | 2 ++ 1 file changed, 2 insertions(+) diff --git a/app/Http/Controllers/Users/LDAPImportController.php b/app/Http/Controllers/Users/LDAPImportController.php index 6e2a3091b0..337a43bc36 100644 --- a/app/Http/Controllers/Users/LDAPImportController.php +++ b/app/Http/Controllers/Users/LDAPImportController.php @@ -6,6 +6,7 @@ use App\Http\Controllers\Controller; use App\Services\LdapAd; use Illuminate\Http\Request; use Illuminate\Support\Facades\Artisan; +use App\Models\User; // Note that this is awful close to 'Users' the namespace above; be careful class LDAPImportController extends Controller { @@ -65,6 +66,7 @@ class LDAPImportController extends Controller */ public function store(Request $request) { + $this->authorize('update', User::class); // Call Artisan LDAP import command. $location_id = $request->input('location_id'); Artisan::call('snipeit:ldap-sync', ['--location_id' => $location_id, '--json_summary' => true]);