I can access role page and edit role without permission about filament-shield HOT 3 CLOSED

Hello,

I have configure a new role without "Role" permission and if i'm log in the account which don't have role permission i view the page and if i edit role and i'm delete "disabled" variable with source i can edit the role.

Screenshots:

Role (super admin account):

Role page (new account without permission):

Edit role (new account without permission):

seems like you haven't configured it properly
register_role_policy' => [ 'enabled' => false ]
set it to true to enforce the Role Policy

from filament-shield.

@bezhanSalleh There is one more big security bug. If i copy any request as CURL from Developer Tools and then update the token and send a request using Postman for the other user i can update, and delete any record so no policy is enforced.

from filament-shield.

@bezhanSalleh There is one more big security bug. If i copy any request as CURL from Developer Tools and then update the token and send a request using Postman for the other user i can update, and delete any record so no policy is enforced.

don't really know what kinda magic are ya trying to achieve here, but shield only generates stuff for filament and the policies only get enforced if it follows the policy guidelines as laravel has set forth. other than that you would need to register them in the AuthServiceProvider...

from filament-shield.