Laravel 4 multiple users security
I am developing a multiple user web application. My concerns are about the security. I am wondering if this is the secure way to put it together?
I have done the following in filters.php, three new fitlers.
/**
*filter.php
*/
Route::filter('auth', function()
{
if (Auth::guest())
{
if (Request::ajax())
{
return Response::make('Unauthorized', 401);
}
else
{
return Redirect::guest('login');
}
}
});
Route::filter('user', function(){
if(Auth::guest()){
return Redirect::route('login');
}else{
if(Auth::user()->role == 2){
return Redirect::route('/users/users');
}
}
});
Route::filter('admin', function(){
if(Auth::guest()){
return Redirect::route('login');
}else{
if(Auth::user()->role == 1){
return Redirect::route('/admin/admin');
}
}
});
Route::filter('business', function(){
if(Auth::guest()){
return Redirect::route('login');
}else{
if(Auth::user()->role == 1){
return Redirect::route('/business/business');
}
}
});
In route.php I have added the following
/**
*
*
*User filter
*
*
*/
Route::group(array('before' => 'admin'), function(){
Route::resource('user', 'UserController');
Route::get('user/dashboard', array(
'as' =>'user-dashboard',
'uses' => 'UserController@show'
));
/*
|admin filter
*/
// Route::group(array('before' => 'user'), function(){
Route::get('admin/dashboard', array(
' as' =>'admin-dashboard',
'uses' => 'AdminController@getAdmin'
));
// });
/**
*
*
*Bussiness filter
*
*
*/
Route::group(array('before' => 'business'), function(){
Route::get('business/dashboard', array(
'as' =>'business-dashboard',
'uses' => 'BusinessController@getBusiness'
));
});
in AdminController.php i have added the following
public function show($id){
$user = User::find($id);
return View::make('admin.show')
->with('title', 'admin dashboard')
->with('user', $user);
}
In the admin/show.blade.php file I have added the following
@extends('layouts.default')
@section('content')
@if(Auth::check())
@if(Auth::user()->role==1)
<div class="container">
<h1>{{ $user->email }}</h1>
@else
<p> you are not signed in</p>
@endif
@else
<?php return Redirect::route('login') ?>
@endif
@stop
in UserController.php I have added the following
public function show(){
return View::make('users.index')
->with('title', 'dashboard');
}
in users/index.blade.php I have added the following
@extends('layouts.default')
@section('content')
@if(Auth::check())
@if(Auth::user()->role==2)
...........
@else
<div class="container">
<h3>your are not signed in</h3>
</div>
@endif
@else
<?php return Redirect::route('login')->with('global', 'your not allowed here') ?>
@endif
@stop
and the bussiness role is done the same way.
in View files for admin
@extends('layouts.default')
@section('content')
@if(Auth::check())
@if(Auth::user()->role==1)
<h2>welcome {{ Auth::user()->email }}, you are logged in as an administrator </h2>
@else
<p> you are not signed in</p>
@endif
@else
<p><?php return Redirect::route('login')->with('global', 'your not allowed here') ?></p>
@endif
@stop
and for users
@extends('layouts.default')
@section('content')
@if(Auth::check())
@if(Auth::user()->role==2)
<h2>welcome {{ Auth::user()->email }}, you are logged in as an user </h2>
@else
<p> you are not signed in</p>
@endif
@else
<p><?php return Redirect::route('login')->with('global', 'your not allowed here') ?></p>
@endif
@stop
Comments
Post a Comment