如何防止其他用户在cakephp3中编辑我的个人资料

Question

I have simple program using cakephp3, when I try to directly put this into browser:

http://localhost/sample/users/edit/82

it directly goes to login page. Then after the login, my code still can edit the profile even that profile is not the current user login.

Below is my edit code

public function edit($id = null)
{
    $user = $this->Users->get($id, [
        'contain' => []
    ]);
    if ($this->request->is(['patch', 'post', 'put'])) {
        $user = $this->Users->patchEntity($user, $this->request->data);


                if ($this->Users->save($user)) {
                    $this->Flash->success(__('The user has been saved.'));
                    return $this->redirect(['action' => 'index']);
                } else {
                    $this->Flash->error(__('The user could not be saved. Please, try again.'));
                }

    }
    $this->set(compact('user'));
    $this->set('_serialize', ['user']);
}


edit.ctp

<div class="actions columns large-2 medium-3">
<h3><?= __('Actions') ?></h3>
 <ul class="side-nav">
    <li><?= $this->Form->postLink(
            __('Delete'),
            ['action' => 'delete', $user->id],
            ['confirm' => __('Are you sure you want to delete # {0}?', 
  $user->id)]
        )
    ?></li>
    <li><?= $this->Html->link(__('List Users'), ['action' => 'index']) ?>
  </li>
</ul>

    <div class="users form large-10 medium-9 columns">
     <?= $this->Form->create($user) ?>
   <fieldset>
      <legend><?= __('Edit User') ?></legend>
      <?php
          echo $this->Form->input('username');
          echo $this->Form->input('password');
      ?>
    </fieldset>
<?= $this->Form->button(__('Submit')) ?>
  <?= $this->Form->end() ?>
</div>

Answer 1

You have to check the existing user is trying to update his/her profile. You can do something like this.

All this on top of your edit method

public function edit($id = null)
{
  $logged_user_id=$this->Auth->user('id');

  if($logged_user_id==$id){
  $user = $this->Users->get($id, [
        'contain' => []
    ]);
    if ($this->request->is(['patch', 'post', 'put'])) {
        $user = $this->Users->patchEntity($user, $this->request->data);


                if ($this->Users->save($user)) {
                    $this->Flash->success(__('The user has been saved.'));
                    return $this->redirect(['action' => 'index']);
                } else {
                    $this->Flash->error(__('The user could not be saved. Please, try again.'));
                }

    }
    $this->set(compact('user'));
    $this->set('_serialize', ['user']);
   } else {
                    $this->Flash->error(__('You are not allowed to do this.'));
     }
}

Answer 2

In my case and like ndm say, i don't use session, that's what i do (hope it helps):

public function edit($id = null)
{

    if(!is_null($this->Auth->user())): // if the user is logged
      if(is_null($id)) { $id = $this->Auth->user('id'); }
      if($this->Auth->user()['group_id']<>1): // in my case group 1 is for the administrator group, i let them edit profile
        $id = $this->Auth->user('id'); // in this case, if the user is not an administrator, id will always be his "user id"
      endif;      
    endif;

    if ($this->request->is(['patch', 'post', 'put'])) {
        $user = $this->Users->patchEntity($user, $this->request->data);
        if ($this->Users->save($user)) {
            $this->Flash->success(__('The user has been saved.'));

            return $this->redirect(['action' => 'edit', $id]);
        }
        $this->Flash->error(__('The user could not be saved. Please, try again.'));
    }

    $this->set(compact('user'));
    $this->set('_serialize', ['user']);
}