Laravel 4 multiple users security

I am developing a multiple user web application. My concerns are about the security. I am wondering if this is the secure way to put it together?
I have done the following in filters.php, three new fitlers.
/**
*filter.php
*/
Route::filter('auth', function()
{
    if (Auth::guest())
    {
        if (Request::ajax())
        {
            return Response::make('Unauthorized', 401);
        }
        else
        {
            return Redirect::guest('login');
        }
    }
});
Route::filter('user', function(){
    if(Auth::guest()){
        return Redirect::route('login');
    }else{
        if(Auth::user()->role == 2){
            return Redirect::route('/users/users');
        }
    }
});

Route::filter('admin', function(){
    if(Auth::guest()){
        return Redirect::route('login');
    }else{
        if(Auth::user()->role == 1){
            return Redirect::route('/admin/admin');
        }
    }
});
Route::filter('business', function(){
    if(Auth::guest()){
        return Redirect::route('login');
    }else{
        if(Auth::user()->role == 1){
            return Redirect::route('/business/business');
        }
    }
});
In route.php I have added the following
        /**
    *
    *
    *User filter
    *
    *
    */
    Route::group(array('before' => 'admin'), function(){

        Route::resource('user', 'UserController');

        Route::get('user/dashboard', array(
            'as' =>'user-dashboard',
            'uses' => 'UserController@show'
        ));


        /*
    |admin filter
    */
    // Route::group(array('before' => 'user'), function(){
                Route::get('admin/dashboard', array(
        '      as' =>'admin-dashboard',
              'uses' => 'AdminController@getAdmin'
    ));

    // });


       /**
    *
    *
    *Bussiness filter
    *
    *
    */
    Route::group(array('before' => 'business'), function(){
        Route::get('business/dashboard', array(
            'as' =>'business-dashboard',
            'uses' => 'BusinessController@getBusiness'
        ));
    });

in AdminController.php i have added the following
public function show($id){
        $user = User::find($id);

        return View::make('admin.show')
        ->with('title', 'admin dashboard')
        ->with('user', $user);
    }
In the admin/show.blade.php file I have added the following
@extends('layouts.default')

@section('content')
    @if(Auth::check())

        @if(Auth::user()->role==1)
        <div class="container">
            <h1>{{ $user->email }}</h1>
                @else
            <p> you are not signed in</p>
        @endif
    @else
        <?php return Redirect::route('login') ?>
    @endif
@stop
in UserController.php I have added the following
public function show(){
        return View::make('users.index')
        ->with('title', 'dashboard');
    }
in users/index.blade.php I have added the following
@extends('layouts.default')

@section('content')
    @if(Auth::check())
        @if(Auth::user()->role==2)
                ........... 
                @else 
        <div class="container">
            <h3>your are not signed in</h3>
        </div>
        @endif
    @else
        <?php return Redirect::route('login')->with('global', 'your not allowed here') ?>
    @endif
@stop

and the bussiness role is done the same way.
in View files for admin
@extends('layouts.default')

@section('content')
    @if(Auth::check())
        @if(Auth::user()->role==1)
            <h2>welcome {{ Auth::user()->email }}, you are logged in as an administrator </h2>
        @else
            <p> you are not signed in</p>
        @endif
    @else
        <p><?php return Redirect::route('login')->with('global', 'your not allowed here') ?></p>
    @endif
@stop
and for users
@extends('layouts.default')

@section('content')
    @if(Auth::check())
        @if(Auth::user()->role==2)
            <h2>welcome {{ Auth::user()->email }}, you are logged in as an user </h2>
        @else
            <p> you are not signed in</p>
        @endif
    @else
        <p><?php return Redirect::route('login')->with('global', 'your not allowed here') ?></p>
    @endif
@stop

Comments

Popular posts from this blog

Bootstrap Tags Input

Laravel 5.8 Files Folders Permissions and Ownership Setup