Allow users that have permission to edit their own location to see locations in select list

2023-07-13 17:37:46 -07:00
parent 232e84acf7
commit 346ace9444
3 changed files with 62 additions and 2 deletions
@@ -253,8 +253,12 @@ class LocationsController extends Controller
     */
    public function selectlist(Request $request)
    {
-
-        $this->authorize('view.selectlists');
+        // If a user is in the process of editing their profile, as determined by the referrer,
+        // then we check that they have permission to edit their own location.
+        // Otherwise, we do our normal check that they can view select lists.
+        $request->headers->get('referer') === route('profile')
+            ? $this->authorize('self.edit_location')
+            : $this->authorize('view.selectlists');

        $locations = Location::select([
            'locations.id',