How to check user Permissions using Custom Middleware in Laravel

Question

I'm developing a Laravel ACL System. My base Table's are users,roles,permissions and pivot tables are role_user,role_permission,user_permission.

I want to check User Permissions using my custom middleware HasPermission. I have tried this way but it's not working properly. every user can access the all the permissions which have or have not.

Now, How can I solve the issue. Please see my code sample.

My Controller.

function __construct()
{
    $this->middleware('auth');
    $this->middleware('HasPermission:Role_Read|Role_Update|Role_Delete');
}

My Middleware.

class HasPermission
{

public function handle($request, Closure $next,$permissions)
{

    $permissions_array = explode('|', $permissions);
    // $user = $this->auth->user();
    foreach($permissions_array as $permission){
        if(!$request->user()->hasPermission($permission)){
            return $next($request);
        }
    }

    return redirect()->back();

 }
}

and, my User Model method.

public function user_permissions()
{
    return $this->belongsToMany(Permission::class,'user_permission');
}

public function hasPermission(string $permission)
{
    if($this->user_permissions()->where('name', $permission)->first())
    {
        return true;
    }
    else
    {
        return false;
    }

}

i'm used hasPermission method inside User Model to check the User Permission. — Gabrielle-M
– Gabrielle-M, Commented Jul 3, 2018 at 12:26
I solve it following this solution: enter link description here — pazthor
– pazthor, Commented Feb 1, 2019 at 19:00

Naveed Ramzan · Accepted Answer · 2018-07-03 12:09:53Z

0

Best way to do is that you need to introduce an new service provider and in that you can check the authorization and permissions.

I made a test project (last year) for db driven permission and I used service provider.

That's the perfect way to implement.

answered Jul 3, 2018 at 12:09

Naveed Ramzan

3,5893 gold badges27 silver badges33 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Naveed Ramzan Over a year ago

Well, yes i can. Please share your email so I will send code and test db Thanks

Gabrielle-M Over a year ago

my email id is [email protected]

Naveed Ramzan Over a year ago

Just added you in a bitbucket repo. YOu need to import database file manually (located in database folder .sql) Further, you may contact at [email protected] and upvote here :)

Gabrielle-M Over a year ago

I can't see anything.

Naveed Ramzan Over a year ago

Not now after checking that :)

apokryfos · Accepted Answer · 2018-07-03 12:26:59Z

Basically !$request->user()->hasPermission($permission) is saying if the user associated with the request does not have this permission the middleware passes, however this is not what you want. Here's what you should do:

If you need the user to have one of the stated permissions you need to do:

class HasPermission
{

    public function handle($request, Closure $next,$permissions)
    {

        $permissions_array = explode('|', $permissions);
        foreach($permissions_array as $permission){
            if ($request->user()->hasPermission($permission)){
                return $next($request);
            }
        }    
       return redirect()->back();    
    }
}

If you want the user to have all stated permissions you need to do:

class HasPermission
{

    public function handle($request, Closure $next,$permissions)
    {

        $permissions_array = explode('|', $permissions);
        foreach($permissions_array as $permission){
            if (!$request->user()->hasPermission($permission)){
                return redirect()->back();                        
            }
        }    
        return $next($request);
    }
}

As an added note if you want to do this in a more elegant way you can do:

class HasPermission
{

    public function handle($request, Closure $next, ...$permissions_array)
    {    
       //Function body from above without the explode part
    }
}

And

function __construct()
{
   $this->middleware('auth');
   $this->middleware('HasPermission:Role_Read,Role_Update,Role_Delete');
}

If you use commas then the framework will split the string into arguments for you .

Hi sir, I just use your code, but like I gave the user (edit and delete) then put __construct in controller but even he does not has permission to edit, he can open the edit page or even delete!

Julius Simanavičius · Accepted Answer · 2018-07-03 12:32:31Z

0

In my case i just added simple function to get permissions from database and then check it Middleware. Check this code:

// Add new function to get permissions from database

public static function user_permissions($user) {

$permissions=DB::table('permissions')->where('user_id', $user)->first();
return $permissions; 

}

// In Middleware check your permissions

   if(Auth::guest())
    {
        return redirect('/');
    }

elseif(Functions::user_permissions(Auth::user()->id)->user_managment != 1) {

 return redirect('/');

} else {
    return $next($request);
}

answered Jul 3, 2018 at 12:32

Julius Simanavičius

2512 silver badges5 bronze badges

Comments

Hamed Alizade · Accepted Answer · 2022-10-10 10:12:47Z

0

In web.php/api.php:

Route::middleware('hasPermission')->group(function() { // for all routes
    Route::get('/article', [ArticleController::class, 'index'])->name('article.index');
});

in middleWare:

class HasPermission
{

    public function handle($request, Closure $next)
    {
        $routeName = Request::route()->getName();
        $permission = $user->permissions()->where('route_name', $routeName)->first();
        if ( ! empty($permission)){
            return redirect()->back();                        
        }
        return $next($request);
    }
}

answered Oct 10, 2022 at 10:12

Hamed Alizade

1671 silver badge7 bronze badges

Collectives™ on Stack Overflow

How to check user Permissions using Custom Middleware in Laravel

4 Answers 4

5 Comments

1 Comment

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

5 Comments

1 Comment

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related