fixed broken access control issue for account update

Author: naresh verma

packages/Webkul/Admin/src/Http/Controllers/User/AccountController.php

@@ -46,6 +46,12 @@ public function update()
             return redirect()->back();
         }
 
+        if( isset($data['role_id']) || isset($data['view_permission']) ) {
+            session()->flash('warning', trans('admin::app.user.account.permission-denied'));
+
+            return redirect()->back();
+        }
+
         if (! $data['password']) {
             unset($data['password']);
         } else {
@@ -63,4 +69,4 @@ public function update()
 
         return redirect()->route('admin.dashboard.index');
     }
-}
+}

packages/Webkul/Admin/src/Resources/lang/en/app.php

@@ -650,6 +650,7 @@
                 'confirm_password'  => 'Confirm password',
                 'password-match'    => 'Current password does not match.',
                 'account-save'      => 'Account changes saved successfully.',
+                'permission-denied' => 'Permission Denied'
             ]
         ],
 
@@ -674,4 +675,4 @@
             ]
         ]
     ];
-?>
+?>