Skip to content

Fix gate check when updating user permissions on a team #1316

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
May 17, 2023

Conversation

drewrawitz
Copy link
Contributor

I think I found a bug where managing a team member's role is being guarded by the canAddTeamMembers permissions instead of canUpdateTeamMembers.

This isn't super obvious right off the bat because they share the exact same logic, which is:

return $user->ownsTeam($team);

I spotted this in my own application when I changed the logic a bit so that both Administrators and Owners can invite new team members, but only Owners should be able to modify user permissions.

@taylorotwell taylorotwell merged commit 6dea0f2 into laravel:3.x May 17, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants