Passing null to the $user->can() method returns true

Viewed 32

I am using Spatie Laravel Permissions with Laravel 8.75. The application is progressing smoothly. When I test whether the current user has a given permission, for instance like this:

$user = auth()->user();
if($user->can('Edit reports'){
    //do something.
}

the user is only allowed to do something if they have that permission. Now, here's the problem:

Due to an unintentional result of the way I had set things up, I discovered I was sometimes passing null to the can method. No exception was thrown, but after careful checking, I discovered that if you pass null to the can method, it returns true, and the user is authorised to proceed, which is the exact opposite of what I wanted. Of course I can add my own extra check to ensure that if I pass null to the can method, I throw an exception, but I was very surprised by this behaviour. Has anyone else noticed this and what did you do?

0 Answers
Related