diff --git a/app/Http/Controllers/PlayerPasswordResetController.php b/app/Http/Controllers/PlayerPasswordResetController.php index 2d8f9a58..1c6a8bd9 100644 --- a/app/Http/Controllers/PlayerPasswordResetController.php +++ b/app/Http/Controllers/PlayerPasswordResetController.php @@ -24,8 +24,9 @@ public function show(Request $request, PluginSettings $pluginSettings) $selectedPlayerUuid = $request->query('player_uuid'); $canResetAnyPlayerPassword = $request->user()->can('reset any_player_password'); + $userOwnPlayer = $linkedPlayers->contains('uuid', $selectedPlayerUuid); // If selected player is not in linked player but user has permission to reset any player password, then allow. - if ($selectedPlayerUuid && !$linkedPlayers->contains('uuid', $selectedPlayerUuid) && $canResetAnyPlayerPassword) { + if ($selectedPlayerUuid && !$userOwnPlayer && $canResetAnyPlayerPassword) { $linkedPlayers = Player::where('uuid', $selectedPlayerUuid)->get(); } @@ -35,11 +36,12 @@ public function show(Request $request, PluginSettings $pluginSettings) $cooldown = now()->diffInSeconds($cooldown->addSeconds($pluginSettings->player_password_reset_cooldown_in_seconds), false); } + $hasCannotPlayerPasswordResetPermission = $request->user()->hasPermissionTo('cannot player_password_reset'); return Inertia::render('Player/ResetPassword', [ 'uuid' => $selectedPlayerUuid, 'players' => $linkedPlayers, 'cooldown' => $cooldown, - 'cannotPlayerPasswordReset' => $request->user()->hasPermissionTo('cannot player_password_reset'), + 'cannotPlayerPasswordReset' => $hasCannotPlayerPasswordResetPermission && !$canResetAnyPlayerPassword, ]); } diff --git a/database/seeders/PermissionSeeder.php b/database/seeders/PermissionSeeder.php index 3aa6c4b3..e1fbe48a 100644 --- a/database/seeders/PermissionSeeder.php +++ b/database/seeders/PermissionSeeder.php @@ -137,15 +137,7 @@ public function run() Permission::findOrCreate('create banwarden_punishments_evidence'); Permission::findOrCreate('delete banwarden_punishments_evidence'); + Permission::findOrCreate('reset any_player_password'); // Ability to change any player password Permission::findOrCreate('cannot player_password_reset'); // User with this permission can't change his own password from web. Good for staff members. - Permission::findOrCreate('reset any_player_password'); // Ability to change any player password - - // Get superadmin role and give all permissions to it. - try { - $superAdmin = Role::where('name', Role::SUPER_ADMIN_ROLE_NAME)->first(); - $superAdmin->givePermissionTo(Permission::all()); - } catch (\Exception $e) { - Log::error("Error giving all permissions to superadmin role: " . $e->getMessage()); - } } }