Restrict PluginController access to super admin only

app/Http/Kernel.php

@@ -45,11 +45,12 @@ class Kernel extends HttpKernel
      * @var array
      */
     protected $routeMiddleware = [
-        'auth'     => \App\Http\Middleware\CheckAuthenticated::class,
-        'verified' => \App\Http\Middleware\CheckUserVerified::class,
-        'guest'    => \App\Http\Middleware\RedirectIfAuthenticated::class,
-        'admin'    => \App\Http\Middleware\CheckAdministrator::class,
-        'player'   => \App\Http\Middleware\CheckPlayerExist::class,
-        'setup'    => \App\Http\Middleware\CheckInstallation::class,
+        'auth'        => \App\Http\Middleware\CheckAuthenticated::class,
+        'verified'    => \App\Http\Middleware\CheckUserVerified::class,
+        'guest'       => \App\Http\Middleware\RedirectIfAuthenticated::class,
+        'admin'       => \App\Http\Middleware\CheckAdministrator::class,
+        'super-admin' => \App\Http\Middleware\CheckSuperAdmin::class,
+        'player'      => \App\Http\Middleware\CheckPlayerExist::class,
+        'setup'       => \App\Http\Middleware\CheckInstallation::class,
     ];
 }

app/Http/Middleware/CheckSuperAdmin.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Symfony\Component\HttpFoundation\Response;
+
+class CheckSuperAdmin
+{
+    public function handle($request, \Closure $next)
+    {
+        $result = (new CheckAuthenticated)->handle($request, $next, true);
+
+        if ($result instanceof Response) {
+            return $result;
+        }
+
+        if (! $result->isSuperAdmin()) {
+            abort(403, trans('auth.check.super-admin'));
+        }
+
+        return $next($request);
+    }
+}

app/Models/User.php

@@ -66,6 +66,16 @@ class User extends Model
         return ($this->permission >= static::ADMIN);
     }
 
+    /**
+     * Check if user is super admin.
+     *
+     * @return bool
+     */
+    public function isSuperAdmin()
+    {
+        return ($this->permission == static::SUPER_ADMIN);
+    }
+
     /**
      * Get closet instance.
      *

resources/lang/en/auth.yml

@@ -9,6 +9,7 @@ check:
   anonymous: Illegal access. Please log in first.
   verified: To access this page, you should verify your email address first.
   admin: Only admins are permitted to access this page.
+  super-admin: Only super admin is permitted to access this page.
   banned: You are banned on this site. Please contact the admin.
   token: Token expired. Please log in.
 

resources/lang/zh_CN/auth.yml

@@ -9,6 +9,7 @@ check:
   anonymous: 未授权的访问，请先登录
   verified: 你必须验证邮箱后才能访问此页面
   admin: 只有管理员才能访问此页面
+  super-admin: 只有超级管理员才能访问此页面
   banned: 你已被本站封禁，详情请联系站点管理员
   token: 登录状态已过期，请重新登录
 

routes/web.php

@@ -121,7 +121,7 @@ Route::group(['middleware' => 'admin', 'prefix' => 'admin'], function ()
     Route::post('/users',      'AdminController@userAjaxHandler');
     Route::post('/players',    'AdminController@playerAjaxHandler');
 
-    Route::group(['prefix' => 'plugins'], function () {
+    Route::group(['prefix' => 'plugins', 'middleware' => 'super-admin'], function () {
         // Allow using POST method to get data for DataTables,
         // otherwise it may cause a "414 Request-URI Too Large" error.
         Route::get ('/manage', 'PluginController@showManage');
@@ -135,7 +135,7 @@ Route::group(['middleware' => 'admin', 'prefix' => 'admin'], function ()
         Route::post('/market/download', 'MarketController@download');
     });
 
-    Route::group(['prefix' => 'update'], function () {
+    Route::group(['prefix' => 'update', 'middleware' => 'super-admin'], function () {
         Route::any('',          'UpdateController@showUpdatePage');
         Route::get('/check',    'UpdateController@checkUpdates');
         Route::any('/download', 'UpdateController@download');

tests/MarketControllerTest.php

@@ -5,7 +5,7 @@ class MarketControllerTest extends TestCase
     protected function setUp()
     {
         parent::setUp();
-        return $this->actAs('admin');
+        return $this->actAs('superAdmin');
     }
 
     public function testShowMarket()

tests/MiddlewareTest.php

@@ -105,6 +105,19 @@ class MiddlewareTest extends TestCase
             ->assertResponseStatus(200);
     }
 
+    public function testCheckSuperAdmin()
+    {
+        // Admin
+        $this->actAs('admin')
+            ->get('/admin/plugins/manage')
+            ->assertResponseStatus(403);
+
+        // Super admin
+        $this->actAs('superAdmin')
+            ->visit('/admin/plugins/manage')
+            ->assertResponseStatus(200);
+    }
+
     public function testCheckInstallation()
     {
         $this->visit('/setup')->see('Already installed');

tests/PluginControllerTest.php

@@ -37,7 +37,7 @@ class PluginControllerTest extends TestCase
             }
         }
 
-        return $this->actAs('admin');
+        return $this->actAs('superAdmin');
     }
 
     public function testShowManage()

tests/UpdateControllerTest.php

@@ -16,7 +16,7 @@ class UpdateControllerTest extends TestCase
 
         vfs\vfsStream::setup();
 
-        return $this->actAs('admin');
+        return $this->actAs('superAdmin');
     }
 
     /**
@@ -136,8 +136,7 @@ class UpdateControllerTest extends TestCase
 
         // Start downloading
         $this->flushCache();
-        $this->actAs('admin')
-            ->get('/admin/update/download?action=start-download')
+        $this->get('/admin/update/download?action=start-download')
             ->see('No temp path available, please try again.');
 
         unlink(storage_path('testing/update.zip'));
@@ -159,8 +158,7 @@ class UpdateControllerTest extends TestCase
 
         // Get file size
         $this->flushCache();
-        $this->actAs('admin')
-            ->get('/admin/update/download?action=get-progress')
+        $this->get('/admin/update/download?action=get-progress')
             ->see('[]');
 
         $this->withCache(['download-progress' => ['total' => 514, 'downloaded' => 114]])