classes/Controllers/Admins.php
public function update($id)
    {
        // Encorce permissions on updating ones own role
        if (!app('decoy.user')->can('update', 'admins') && Request::has('role')) {
            throw new AccessDeniedHttpException;
        }

        // If the password is empty, remove the key from the input so it isn't cleared
        if (!Request::has('password')) {
            Request::replace(array_except(Request::input(), ['password']));
        }

        // Continue processing
        return parent::update($id);
    }
public function update($id)
    {
        // Encorce permissions on updating ones own role
        if (!app('decoy.user')->can('update', 'admins') && Request::has('role')) {
            throw new AccessDeniedHttpException;
        }

        // If the password is empty, remove the key from the input so it isn't cleared
        if (!Request::has('password')) {
            Request::replace(array_except(Request::input(), ['password']));
        }

        // Continue processing
        return parent::update($id);
    }
public function update ( $ id ) { // Encorce permissions on updating ones own role if ( ! app ( 'decoy.user' ) -> can ( 'update' , 'admins' ) && Request :: has ( 'role' ) ) { throw new AccessDeniedHttpException ; } // If the password is empty, remove the key from the input so it isn't cleared if ( ! Request :: has ( 'password' ) ) { Request :: replace ( array_except ( Request :: input ( ) , [ 'password' ] ) ) ; } // Continue processing return parent :: update ( $ id ) ; }
Don't let unauthorize folks update their role by passing in role values
in the GET

@param  int                                       $id Model key
@throws AccessDeniedHttpException
@return Symfony\Component\HttpFoundation\Response
Don t let unauthorize folks update their role by passing in role values in the GET