forge-joniko/ldc-supportweb
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: 🔒 validates only the email address and prevents data leaks on post forgotten password

Browse source
This commit is contained in:
Alexis Gousseau 2026-06-05 12:08:07 +02:00
parent 1482619622
commit f0311baaac
No known key found for this signature in database
GPG key ID: 7F3C786EE12DBB72
1 changed files with 12 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
app/Http/Controllers/Auth/AuthenticatedSessionController.php
View file

@ -13,6 +13,7 @@ use Illuminate\Http\Request;
use Illuminate\Routing\Controller;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Facades\Log;
use Illuminate\Support\Facades\Mail;
use Illuminate\Support\Facades\Password;
use Illuminate\Support\Str;
@ -81,12 +82,18 @@ class AuthenticatedSessionController extends Controller
*/
public function postForgotPassword(ForgotPasswordRequest $request): \Illuminate\Http\RedirectResponse
{
$validatedData = $request->validated();
$status = Password::broker('backend')->sendResetLink($validatedData);
$status = Password::broker('backend')->sendResetLink(
$request->validated()
);
return $status === Password::RESET_LINK_SENT
? to_route(config('uwil-backend.routes.name') . 'login')
: back()->withErrors(['email' => trans('auth.throttled')]);
if ($status !== Password::RESET_LINK_SENT) {
Log::warning('Password reset link not sent', [
'status' => $status,
'email' => $request->input('email'),
]);
}
return to_route(config('uwil-backend.routes.name') . 'login');
}
/**