tarunn's avatar
Level 12

Auth login only user with super-admin role

I am facing strange issue, I don't understand what is happening here.

I had implemented entrust for roles and permissions. I have 3 Roles, super-admin, admin and customer.

Super Admin has access to Web-app (eg. www.myurl.com) Admin has access through api only i.e. mobile app (eg. www.myurl.com/api/login) via api.php route customer had access through api i.e. mobile app

Now, I found a bug that when admin tries to login via www.myurl.com.login with his credentials he is allowed to log in!!!

I found that I need to change the login method and provide role check while login, but I'm unable to get through. I changed the bold part but still admin is able to login.

    public function login(Request $request)
    {
        $this->validateLogin($request);

        // If the class is using the ThrottlesLogins trait, we can automatically throttle
        // the login attempts for this application. We'll key this by the username and
        // the IP address of the client making these requests into this application.
        if ($this->hasTooManyLoginAttempts($request)) {
            $this->fireLockoutEvent($request);

            return $this->sendLockoutResponse($request);
        }

//I updated here
        $checkAdmin = $this->attemptLogin($request);
        $isAdmin = Auth::user();
        
        if ( $checkAdmin  && $isAdmin->hasRole('super')) {
            
            return $this->sendLoginResponse($request);
        }
        .
        .

The other method which I found as to use the authenticated function, but in that after checking the roles, if I logout the user, it doesn't give any error as why he was not logged in.

Need you help here. Thanks in advance

0 likes
0 replies

Please or to participate in this conversation.