From 79150ddca803a3bf38046413299b507f6506e081 Mon Sep 17 00:00:00 2001
From: printempw <h@prinzeugen.net>
Date: Thu, 16 Aug 2018 14:02:37 +0800
Subject: [PATCH] Fix CSRF verification compatibility with plugins

---
 app/Exceptions/Handler.php              | 5 ++++-
 app/Http/Kernel.php                     | 2 +-
 app/Http/Middleware/VerifyCsrfToken.php | 2 +-
 app/Providers/RouteServiceProvider.php  | 2 +-
 4 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/app/Exceptions/Handler.php b/app/Exceptions/Handler.php
index 08b40a9c..bc949edf 100644
--- a/app/Exceptions/Handler.php
+++ b/app/Exceptions/Handler.php
@@ -58,7 +58,10 @@ class Handler extends ExceptionHandler
         }
 
         if ($e instanceof TokenMismatchException) {
-            return json(trans('errors.http.csrf-token-mismatch'), 1);
+            if (request()->ajax()) {
+                return json(trans('errors.http.csrf-token-mismatch'), 1);
+            }
+            abort(403, trans('errors.http.csrf-token-mismatch'));
         }
 
         if ($e instanceof PrettyPageException) {
diff --git a/app/Http/Kernel.php b/app/Http/Kernel.php
index 56e92283..4702f632 100644
--- a/app/Http/Kernel.php
+++ b/app/Http/Kernel.php
@@ -31,7 +31,6 @@ class Kernel extends HttpKernel
             \Illuminate\View\Middleware\ShareErrorsFromSession::class,
             \App\Http\Middleware\AfterSessionBooted::class,
             \App\Http\Middleware\DetectLanguagePrefer::class,
-            \App\Http\Middleware\VerifyCsrfToken::class,
         ],
 
         'static' => [],
@@ -45,6 +44,7 @@ class Kernel extends HttpKernel
      * @var array
      */
     protected $routeMiddleware = [
+        'csrf'        => \App\Http\Middleware\VerifyCsrfToken::class,
         'auth'        => \App\Http\Middleware\CheckAuthenticated::class,
         'verified'    => \App\Http\Middleware\CheckUserVerified::class,
         'guest'       => \App\Http\Middleware\RedirectIfAuthenticated::class,
diff --git a/app/Http/Middleware/VerifyCsrfToken.php b/app/Http/Middleware/VerifyCsrfToken.php
index bcb9ceec..a2c35414 100644
--- a/app/Http/Middleware/VerifyCsrfToken.php
+++ b/app/Http/Middleware/VerifyCsrfToken.php
@@ -12,6 +12,6 @@ class VerifyCsrfToken extends BaseVerifier
      * @var array
      */
     protected $except = [
-        'setup/*'
+        //
     ];
 }
diff --git a/app/Providers/RouteServiceProvider.php b/app/Providers/RouteServiceProvider.php
index 9991c6f1..c3ead134 100644
--- a/app/Providers/RouteServiceProvider.php
+++ b/app/Providers/RouteServiceProvider.php
@@ -59,7 +59,7 @@ class RouteServiceProvider extends ServiceProvider
     protected function mapWebRoutes(Router $router)
     {
         $router->group([
-            'middleware' => ['web', CheckSessionUserValid::class],
+            'middleware' => ['web', CheckSessionUserValid::class, 'csrf'],
             'namespace' => $this->namespace,
         ], function ($router) {
             require base_path('routes/web.php');