diff --git a/app/Containers/AppSection/Authorization/Traits/IsResourceOwnerTrait.php b/app/Containers/AppSection/Authorization/Traits/IsResourceOwnerTrait.php index 9adbca1d8..f9ea14bfc 100644 --- a/app/Containers/AppSection/Authorization/Traits/IsResourceOwnerTrait.php +++ b/app/Containers/AppSection/Authorization/Traits/IsResourceOwnerTrait.php @@ -10,6 +10,10 @@ trait IsResourceOwnerTrait */ public function isResourceOwner(): bool { + if ($this->user()->hasAnyRole(config('apiato.requests.allow-roles-to-access-all-routes'))) { + return true; + } + return hash_equals((string)$this->user()->getKey(), (string)$this->id); } }