How to prevent select option to be changed using inspect element
Hello,
I am using 3 roles in my project (super-admin, admin, editor)
I have a custom config file which has these 3 roles and I can access them using config('custom.roles')
The user permissions to add new users are like this
super-admin can add admin and editor
admin can only add editor
editor has no access to add any user
my question is that I have a select option which loads options from config('custom.roles') and it shows all 3 roles when super-admin or admin is adding a user, I have changed it conditionally to load only the roles that these users can add but the main issue is when I am logged in as admin and inspect element to edit the select options and change the value to super-admin it lets me add super-admin using the admin role.
Please let me know how do I make this secure so the user can only add the roles that they are permitted to.
Thank you so much.
2 Replies
Never trust user input. Always validate the submitted data.
So, put your validation checks in the part of your code that's parsing the submitted form data, before saving.
You haven't posted any of your Form code or the Resource or Model it relates to, so it's hard to give you appropriate code suggestions.
You could use policies, you could use validation rules, you could use Gate rules, you could use beforeSaving events, you could use observers to parse before saving. Lots of options depending on your app.
Don't worry about browser tampering as much as ensuring the submitted data is allowed. Do all that server-side, never in browser.
@DrByte thank you so much for the detailed reply. I changed the config to have separate sets for each role and then validate them using in: and it works good. I just wanted to do it with the same config without separating them and the reason to ask here is because I thought there was a built-in trait or any method which I wasn't aware of.
The validation works with the separate set of rules and there are only these roles so I will stick to that.
Thank you so much 🙂