Laravel-Backpack / PermissionManager

Admin interface for managing users, roles, permissions, using Backpack CRUD
http://backpackforlaravel.com
Other
527 stars 168 forks source link

Users can still access the url if they have permisison #338

Closed medeepaksaini closed 1 year ago

medeepaksaini commented 1 year ago

Bug report

What I did: added few permisison/ role to user

What I expected to happen: limited user permissions/ roles

What happened: user can still access the url when they don't have the permisison/role to view that details

What I've already tried to fix it: Seetting middleware

Backpack, Laravel, PHP, DB version: 6, 10, 8.2

If we have set the permission/ role we can still access data using URL, same issue in Laravel Backpack demo also.

welcome[bot] commented 1 year ago

Hello there! Thanks for opening your first issue on this repo!

Just a heads-up: Here at Backpack we use Github Issues only for tracking bugs. Talk about new features is also acceptable. This helps a lot in keeping our focus on improving Backpack. If you issue is not a bug/feature, please help us out by closing the issue yourself and posting in the appropriate medium (see below). If you're not sure where it fits, it's ok, a community member will probably reply to help you with that.

Backpack communication mediums:

Please keep in mind Backpack offers no official / paid support. Whatever help you receive here, on Gitter, Slack or Stackoverflow is thanks to our awesome awesome community members, who give up some of their time to help their peers. If you want to join our community, just start pitching in. We take pride in being a welcoming bunch.

Thank you!

-- Justin Case The Backpack Robot

tabacitu commented 1 year ago

Hi @medeepaksaini ,

That's normal. This package does NOT limit access, according to the roles or permissions you've added. It would be impossible to do so, we have no way of knowing what roles or permissions you added. This package is just a way to add/edit/delete entries in the Roles and Permissions tables in the database, nothing more.

After you've added roles and permissions to your database, you have to code the limitations yourself, depending on what roles and permissions you have. Use the spatie/laravel-permission API for that. We've made a quick copy-paste for you here - https://github.com/Laravel-Backpack/PermissionManager#api-usage

Hope it helps. Cheers!