Leisuretimedock/blessing-skin-server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add signature check for visiting "reset" page

Browse Source
This commit is contained in:
Pig Fang 2020-03-30 10:01:37 +08:00
parent 9e87f42dd9
commit b7ac9bbfa1
2 changed files with 16 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
app/Http/Controllers/AuthController.php
View File

@ -279,8 +279,10 @@ class AuthController extends Controller
return json(trans('auth.forgot.success'), 0); return json(trans('auth.forgot.success'), 0);
} }
public function reset($uid) public function reset(Request $request, $uid)
{ {
abort_unless($request->hasValidSignature(false), 403, trans('auth.reset.invalid'));
return view('auth.reset')->with('user', User::find($uid)); return view('auth.reset')->with('user', User::find($uid));
} }

16
tests/HttpTest/ControllersTest/AuthControllerTest.php
View File

@ -602,10 +602,20 @@ class AuthControllerTest extends TestCase
public function testReset() public function testReset()
{ {
$user = factory(User::class)->create(); $user = factory(User::class)->create();
$url = URL::temporarySignedRoute(
'auth.reset',
now()->addHour(),
['uid' => $user->uid],
false
);
$this->get($url)->assertSuccessful();
$this->get( $url = URL::temporarySignedRoute(
URL::temporarySignedRoute('auth.reset', now()->addHour(), ['uid' => $user->uid]) 'auth.reset',
)->assertSuccessful(); now()->addHour(),
['uid' => $user->uid]
);
$this->get($url)->assertForbidden();
} }
public function testHandleReset() public function testHandleReset()