mirror of
https://github.com/coollabsio/coolify.git
synced 2026-10-29 01:54:37 +08:00
Andras Bacsai
4f8bf46feb
PUT /user/profile-information changed the email with no SSO check and no verification. The profile page has its own verified email change, so the Fortify feature, its action and its binding are removed.
39 lines
1.2 KiB
PHP
39 lines
1.2 KiB
PHP
<?php
|
|
|
|
use App\Models\InstanceSettings;
|
|
use App\Models\OauthIdentity;
|
|
use App\Models\User;
|
|
use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Illuminate\Support\Facades\Route;
|
|
|
|
uses(RefreshDatabase::class);
|
|
|
|
beforeEach(function () {
|
|
InstanceSettings::forceCreate(['id' => 0]);
|
|
});
|
|
|
|
it('does not let a user change the email through the Fortify profile route', function (bool $hasSsoIdentity) {
|
|
$user = User::factory()->create(['email' => 'owner@example.com']);
|
|
if ($hasSsoIdentity) {
|
|
OauthIdentity::create([
|
|
'user_id' => $user->id,
|
|
'provider' => 'github',
|
|
'issuer' => 'github',
|
|
'provider_user_id' => '123',
|
|
'email' => 'owner@example.com',
|
|
]);
|
|
}
|
|
|
|
$this->actingAs($user)
|
|
->withoutMiddleware(VerifyCsrfToken::class)
|
|
->put('/user/profile-information', ['name' => 'Changed', 'email' => 'attacker@example.com']);
|
|
|
|
expect(Route::has('user-profile-information.update'))->toBeFalse()
|
|
->and($user->fresh()->email)->toBe('owner@example.com')
|
|
->and($user->fresh()->name)->not->toBe('Changed');
|
|
})->with([
|
|
'SSO user' => [true],
|
|
'password user' => [false],
|
|
]);
|