Auth login only user with super-admin role
I am facing strange issue, I don't understand what is happening here.
I had implemented entrust for roles and permissions. I have 3 Roles, super-admin, admin and customer.
Super Admin has access to Web-app (eg. www.myurl.com) Admin has access through api only i.e. mobile app (eg. www.myurl.com/api/login) via api.php route customer had access through api i.e. mobile app
Now, I found a bug that when admin tries to login via www.myurl.com.login with his credentials he is allowed to log in!!!
I found that I need to change the login method and provide role check while login, but I'm unable to get through. I changed the bold part but still admin is able to login.
public function login(Request $request)
{
$this->validateLogin($request);
// If the class is using the ThrottlesLogins trait, we can automatically throttle
// the login attempts for this application. We'll key this by the username and
// the IP address of the client making these requests into this application.
if ($this->hasTooManyLoginAttempts($request)) {
$this->fireLockoutEvent($request);
return $this->sendLockoutResponse($request);
}
//I updated here
$checkAdmin = $this->attemptLogin($request);
$isAdmin = Auth::user();
if ( $checkAdmin && $isAdmin->hasRole('super')) {
return $this->sendLoginResponse($request);
}
.
.
The other method which I found as to use the authenticated function, but in that after checking the roles, if I logout the user, it doesn't give any error as why he was not logged in.
Need you help here. Thanks in advance
Please or to participate in this conversation.