user A session gets user B session laravel 5.6 - php

Question

The user A logged in with the role "admin". User B logged in as role "LimitedUser" on same web portal.
User A changes the permissions for use B. Both of them are on same page, i.e "Attach Permission to Role Page". User A disallows user B to access the page, and when User A submits the form, User B refreshes their page and gets the session of User A. This happens only if User A submits the form and User B redirects the page at the same time.
Laravel Version: 5.6
Entrust for Role Management
Session: File Based
Here's the code.
function updatePermissions(Request $request)
{
if (!hasRole('SuperAdmin') && !userCan('attach_permissions')) {
abort('404');
}
$roleId = $request->input('role_id');
$permIds = $request->input('perm');
$role = Role::where('id', '=', $roleId)->first();
if (!$role) {
abort('404');
}
if ($permIds == null) {
$role = Role::findOrFail($roleId);
$role_permissions = $role->perms()->get();
//print_r($role_permissions);exit;
$rolePermIds = array();
foreach ($role_permissions as $permission) {
$rolePermIds[] = $permission->id;
}
$role->perms()->detach($rolePermIds);
} else {
/*$role->perms()->sync(array_keys($permIds));*/
$permissions_new = (array_keys($permIds));
RolePermission::where('role_id', '=', $roleId)->forceDelete();
foreach ($permissions_new as $item) {
$r = new RolePermission();
$r->role_id = $role->id;
$r->permission_id = $item;
$r->save();
}
}
return redirect()->back();
}

Answer 1

there are several ways to solve this, one of them is to do Middleware in Laravel. https://laravel.com/docs/5.7/middleware#defining-middleware
Another way, creating Policies and Gates
https://laravel.com/docs/5.7/authorization#gates
In the your case, middleware can solve.