Task 7 - update forbidden field

app/Http/Controllers/UserController.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Http\Requests\UpdateUserRequest;
+use App\Models\User;
+
+class UserController extends Controller
+{
+    public function update(User $user, UpdateUserRequest $request)
+    {
+        // TASK: change this line to not allow is_admin field to be updated
+        // Update only the fields that are validated in UpdateUserRequest
+        $user->update($request->all());
+
+        return 'Success';
+    }
+}

app/Http/Requests/UpdateUserRequest.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class UpdateUserRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     *
+     * @return bool
+     */
+    public function authorize()
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array
+     */
+    public function rules()
+    {
+        return [
+            'name' => 'required',
+            'email' => 'required',
+        ];
+    }
+}

app/Models/User.php

@@ -21,6 +21,7 @@ class User extends Authenticatable
         'name',
         'email',
         'password',
+        'is_admin',
     ];
 
     /**