如何限制用户只能查看自己的个人资料

Question

我有一个视图（resources/view/front/auth/profile.blade.php），我在web.php文件中的路线是：

Route::get('/profile/{user}','UserController@edit')

    ->name('profile')

    ->middleware('profilecheck');

我的问题是，当用户登录并被重定向到他们自己的个人资料页面 ( http://exmaple.com/profile/2) 时，他/她可以将 URL 更改为http://exmaple.com/profile/3并查看其他用户的个人资料。

我想使用中间件检查带有 URL 参数的经过身份验证的用户 ID {user}。$user->id遗嘱传给了，{user}但我不知道如何。

中间件UserProfile.php：

<?php

namespace App\Http\Middleware;

use App\User;

use Closure;

class UserProfile

{

    /**

     * Handle an incoming request.

     *

     * @param  \Illuminate\Http\Request  $request

     * @param  \Closure  $next

     * @return mixed

     */

    public function handle($request, Closure $next)

    {

        // $request->user()->id

        // Auth::user()->id

        return $next($request);

    }

}

Answer 1

您可以简单地通过从 URL 中删除用户 ID 来保护路由，而是通过身份验证会话获取它。因此，您的路线签名应该来自：Route::get('/profile/{user}', 'UserController@edit')->name('profile');对此：Route::get('/profile', 'UserController@edit')->name('profile');因此，在您的控制器中，而不是从请求中获取用户 ID：public function edit(Request $request){&nbsp; &nbsp; &nbsp;$user = User::findOrFail($request->id);&nbsp; &nbsp; &nbsp;// ...}您可以User通过Auth外观登录：use Illuminate\Support\Facades\Auth;public function edit(Request $request){&nbsp; &nbsp; &nbsp;$user = Auth::user();&nbsp; &nbsp; &nbsp;// ...}或者只是auth()帮手：public function edit(Request $request){&nbsp; &nbsp; &nbsp;$user = auth()->user();&nbsp; &nbsp; &nbsp;// ...}这样，您就可以屏蔽 URL 以避免恶意用户做他/她不应该做的事情。

Answer 2

// Controller&nbsp;&nbsp;public function index()&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; if (Auth::check() && Auth::user()->role->id == 2) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return view('author.setting.settings');&nbsp; &nbsp; &nbsp; &nbsp; } else {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Toastr::info('you are not authorized to access', 'Info');&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return redirect()->route('login');&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }// Route&nbsp;Route::group(['as'=>'user.','prefix'=>'user','namespace'=>'Author','middleware'=>['auth','user']], function (){&nbsp; &nbsp; Route::get('/setting','SettingsController@index')->name('settings.settings');});

Answer 3

你需要做这样的事情。你的路线Route::get('/profile', [&nbsp; &nbsp; 'uses' => 'UserController@profile',&nbsp; &nbsp; 'middleware' => 'profilecheck']);你的中间件class CheckUserMiddleware{&nbsp; &nbsp;&nbsp;&nbsp; public function handle($request, Closure $next)&nbsp; {&nbsp; &nbsp; if(!auth()->user()) {&nbsp; &nbsp; &nbsp; &nbsp; return redirect()->route('login');&nbsp; &nbsp; }&nbsp; &nbsp; return $next($request);&nbsp; }}