mirror of
https://github.com/coollabsio/coolify.git
synced 2026-10-29 01:54:37 +08:00
Users with a linked OAuth identity or no password cannot confirm a password they do not know. The password.confirm middleware now follows User::requiresPasswordConfirmation(), like destructive actions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
23 lines
672 B
PHP
23 lines
672 B
PHP
<?php
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use Illuminate\Auth\Middleware\RequirePassword as Middleware;
|
|
|
|
class RequirePassword extends Middleware
|
|
{
|
|
/**
|
|
* Users with a linked OAuth identity, or without a password, cannot confirm
|
|
* a password they do not know. They follow the same rule as destructive
|
|
* actions (see User::requiresPasswordConfirmation()).
|
|
*/
|
|
protected function shouldConfirmPassword($request, $passwordTimeoutSeconds = null)
|
|
{
|
|
if ($request->user()?->requiresPasswordConfirmation() === false) {
|
|
return false;
|
|
}
|
|
|
|
return parent::shouldConfirmPassword($request, $passwordTimeoutSeconds);
|
|
}
|
|
}
|