Don't let users change the password from the update endpoint.

joselfonseca · joselfonseca · commit f752208e1f6e · 2017-06-18T13:58:41.000-05:00
diff --git a/app/Http/Controllers/Api/Users/UsersController.php b/app/Http/Controllers/Api/Users/UsersController.php
@@ -100,7 +100,8 @@ public function update(Request $request, $uuid)
             ];
         }
         $this->validate($request, $rules);
-        $user->update($request->except('_token'));
+        // Except password as we don't want to let the users change a password from this endpoint
+        $user->update($request->except('_token', 'password'));
         if($request->has('roles')) {
             $user->syncRoles($request['roles']);
         }

Original file line number	Diff line number	Diff line change
`@@ -100,7 +100,8 @@ public function update(Request $request, $uuid)`
`100`	`100`	`];`
`101`	`101`	`}`
`102`	`102`	`$this->validate($request, $rules);`
`103`		`- $user->update($request->except('_token'));`
	`103`	`+ // Except password as we don't want to let the users change a password from this endpoint`
	`104`	`+ $user->update($request->except('_token', 'password'));`
`104`	`105`	`if($request->has('roles')) {`
`105`	`106`	`$user->syncRoles($request['roles']);`
`106`	`107`	`}`