From f0311baaacc7bbb4cea011586b9c30871056fe6c Mon Sep 17 00:00:00 2001 From: Alexis Gousseau Date: Fri, 5 Jun 2026 12:08:07 +0200 Subject: [PATCH] fix: :lock: validates only the email address and prevents data leaks on post forgotten password --- .../Auth/AuthenticatedSessionController.php | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/app/Http/Controllers/Auth/AuthenticatedSessionController.php b/app/Http/Controllers/Auth/AuthenticatedSessionController.php index cf3cadd..275b24b 100644 --- a/app/Http/Controllers/Auth/AuthenticatedSessionController.php +++ b/app/Http/Controllers/Auth/AuthenticatedSessionController.php @@ -13,6 +13,7 @@ use Illuminate\Http\Request; use Illuminate\Routing\Controller; use Illuminate\Support\Facades\Auth; use Illuminate\Support\Facades\Hash; +use Illuminate\Support\Facades\Log; use Illuminate\Support\Facades\Mail; use Illuminate\Support\Facades\Password; use Illuminate\Support\Str; @@ -81,12 +82,18 @@ class AuthenticatedSessionController extends Controller */ public function postForgotPassword(ForgotPasswordRequest $request): \Illuminate\Http\RedirectResponse { - $validatedData = $request->validated(); - $status = Password::broker('backend')->sendResetLink($validatedData); + $status = Password::broker('backend')->sendResetLink( + $request->validated() + ); - return $status === Password::RESET_LINK_SENT - ? to_route(config('uwil-backend.routes.name') . 'login') - : back()->withErrors(['email' => trans('auth.throttled')]); + if ($status !== Password::RESET_LINK_SENT) { + Log::warning('Password reset link not sent', [ + 'status' => $status, + 'email' => $request->input('email'), + ]); + } + + return to_route(config('uwil-backend.routes.name') . 'login'); } /**