Merge pull request #195 from naresh-webkul/master

fixed broken access control issue for account update

Author: jitendra-webkul

packages/Webkul/Admin/src/Http/Controllers/User/AccountController.php

@@ -46,6 +46,12 @@ public function update()
             return redirect()->back();
         }
 
+        if( isset($data['role_id']) || isset($data['view_permission']) ) {
+            session()->flash('warning', trans('admin::app.user.account.permission-denied'));
+
+            return redirect()->back();
+        }
+
         if (! $data['password']) {
             unset($data['password']);
         } else {
@@ -63,4 +69,4 @@ public function update()
 
         return redirect()->route('admin.dashboard.index');
     }
-}
+}

packages/Webkul/Admin/src/Resources/lang/en/app.php

@@ -716,6 +716,7 @@
                 'confirm_password'  => 'Confirm password',
                 'password-match'    => 'Current password does not match.',
                 'account-save'      => 'Account changes saved successfully.',
+                'permission-denied' => 'Permission Denied'
             ]
         ],
 
@@ -740,4 +741,4 @@
             ]
         ]
     ];
-?>
+?>

packages/Webkul/UI/publishable/assets/js/ui.js

@@ -36,7 +36,7 @@
                         :key="rowIndex"
                         v-if="column.type != 'hidden'"
                         @click="redirectRow(row.redirect_url)"
-                        v-html="getRowContent(row[column.index])"
+                        v-text="getRowContent(row[column.index])"
                         :title="column.title ? row[column.index] : ''"
                         :class="[row.redirect_url ? 'cursor-pointer' : '', column.class || column.index ]"
                     ></td>
@@ -174,7 +174,7 @@
                                     type    : "success",
                                     message : response.data.message,
                                 });
-    
+
                                 EventBus.$emit('refresh_table_data', {usePrevious: true});
                             }
                         }
@@ -189,4 +189,4 @@
             }
         }
     };
-</script>
+</script>