How to secure laravel-permission modules, file-manager or settings? - php

Question

I created two roles: admin and editor. I can secure the menus of these modules directly into the resources/views/vendor/backpack/base/inc/sidebar.blade.php using
#role('admin')
<li class="header">{{ trans('backpack::base.administration') }}</li>
<!-- ================================================ -->
<!-- ==== Recommended place for admin menu items ==== -->
<!-- ================================================ -->
<li><i class="fa fa-dashboard"></i> <span>{{ trans('backpack::base.dashboard') }}</span></li>
<li><i class="fa fa-files-o"></i> <span>File manager</span></li>
<li><i class="fa fa-hdd-o"></i> <span>Backups</span></li>
<li><i class="fa fa-terminal"></i> <span>Logs</span></li>
<li><i class="fa fa-cog"></i> <span>Settings</span></li>
<!-- ======================================= -->
<li class="header">{{ trans('backpack::base.user') }}</li>
<!-- Users, Roles Permissions -->
<li class="treeview">
<i class="fa fa-group"></i> <span>Users, Roles, Permissions</span> <i class="fa fa-angle-left pull-right"></i>
<ul class="treeview-menu">
<li><i class="fa fa-user"></i> <span>Users</span></li>
<li><i class="fa fa-group"></i> <span>Roles</span></li>
<li><i class="fa fa-key"></i> <span>Permissions</span></li>
</ul>
</li>
#endrole
<li><i class="fa fa-sign-out"></i> <span>{{ trans('backpack::base.logout') }}</span></li>
</ul>
Of course, this is not the end, as you still have to secure access to the module for the editor by entering the URL. in vendor/backpack/permissionmanager/src/app/Http/Controllers/PermissionCrudController.php method setup can use
Auth::user()->hasRole('admin')
and throw error or redirect but ...
This is not a good solution (writing in modules in vendor). What should I do? How to secure editor access to the mentioned modules. Sorry if it's too easy for you, I'm just starting to have fun with Laravel
PS. https://github.com/spatie/laravel-permission/issues/507

Answer 1

I'd recommend creating middleware to check for a permission or a role, and lock people out using role:admin or permission:admin, something like this:
PermissionMiddleware.php:
<?php
namespace App\Http\Middleware;
use Closure;
use Auth;
class PermissionMiddleware
{
/**
* Handle an incoming request.
*
* #param \Illuminate\Http\Request $request
* #param \Closure $next
* #return mixed
*/
public function handle($request, Closure $next, $permission)
{
if (Auth::guest()) {
return redirect('login');
}
if (! $request->user()->can($permission)) {
abort(403);
}
return $next($request);
}
}
RoleMiddleware.php:
<?php
namespace App\Http\Middleware;
use Closure;
use Auth;
class RoleMiddleware
{
/**
* Handle an incoming request.
*
* #param \Illuminate\Http\Request $request
* #param \Closure $next
* #return mixed
*/
public function handle($request, Closure $next, $role)
{
if (Auth::guest()) {
return redirect('login');
}
if (! $request->user()->hasRole($role)) {
abort(403);
}
return $next($request);
}
}
You should then be able to use these when you write the routes to your CRUDs. If you want to overwrite the routes created in Backpack\Base, you should be able to easily do that by creating a file routes/backpack/base.php. Backpack will then load that file, instead of the one in the package. See https://github.com/laravel-backpack/base#overwriting-functionality for more details.
Hope it helps!