Files
Andras BacsaiandClaude Opus 5.5 f75ffd329f fix(auth): let OAuth-only users enable 2FA without a password confirmation
Users with a linked OAuth identity or no password cannot confirm a
password they do not know. The password.confirm middleware now follows
User::requiresPasswordConfirmation(), like destructive actions.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-02 16:01:10 +02:00

23 lines
672 B
PHP

<?php
namespace App\Http\Middleware;
use Illuminate\Auth\Middleware\RequirePassword as Middleware;
class RequirePassword extends Middleware
{
/**
* Users with a linked OAuth identity, or without a password, cannot confirm
* a password they do not know. They follow the same rule as destructive
* actions (see User::requiresPasswordConfirmation()).
*/
protected function shouldConfirmPassword($request, $passwordTimeoutSeconds = null)
{
if ($request->user()?->requiresPasswordConfirmation() === false) {
return false;
}
return parent::shouldConfirmPassword($request, $passwordTimeoutSeconds);
}
}