From fb80ec2e32273e8c50fb9ca94dcbd26dc13a06b6 Mon Sep 17 00:00:00 2001 From: Ryan Mitchell Date: Thu, 23 Nov 2023 07:52:23 +0000 Subject: [PATCH 1/5] Use RedirectIfAuthorized middleware on password reset & activate pages --- src/Http/Controllers/ActivateAccountController.php | 6 ++++++ src/Http/Middleware/CP/RedirectIfAuthorized.php | 4 ++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/src/Http/Controllers/ActivateAccountController.php b/src/Http/Controllers/ActivateAccountController.php index 41e5481fb41..b53c7dc0690 100644 --- a/src/Http/Controllers/ActivateAccountController.php +++ b/src/Http/Controllers/ActivateAccountController.php @@ -4,9 +4,15 @@ use Illuminate\Support\Facades\Password; use Statamic\Auth\Passwords\PasswordReset; +use Statamic\Http\Middleware\CP\RedirectIfAuthorized; class ActivateAccountController extends ResetPasswordController { + public function __construct() + { + $this->middleware(RedirectIfAuthorized::class); + } + protected function resetFormAction() { return route('statamic.account.activate.action'); diff --git a/src/Http/Middleware/CP/RedirectIfAuthorized.php b/src/Http/Middleware/CP/RedirectIfAuthorized.php index 4c13190864a..cb0b3ca5fde 100644 --- a/src/Http/Middleware/CP/RedirectIfAuthorized.php +++ b/src/Http/Middleware/CP/RedirectIfAuthorized.php @@ -16,8 +16,8 @@ class RedirectIfAuthorized */ public function handle($request, Closure $next, $guard = null) { - if (User::current()) { - return redirect(cp_route('index')); + if ($user = User::current()) { + return redirect($user->can('access cp') ? cp_route('index') : '/'); } return $next($request); From 1bce2dc269fee8fdbba9dfed7fac30cc41dae068 Mon Sep 17 00:00:00 2001 From: Ryan Mitchell Date: Thu, 23 Nov 2023 12:16:02 +0000 Subject: [PATCH 2/5] Add toast --- src/Http/Middleware/CP/RedirectIfAuthorized.php | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/Http/Middleware/CP/RedirectIfAuthorized.php b/src/Http/Middleware/CP/RedirectIfAuthorized.php index cb0b3ca5fde..e1f23222eb1 100644 --- a/src/Http/Middleware/CP/RedirectIfAuthorized.php +++ b/src/Http/Middleware/CP/RedirectIfAuthorized.php @@ -3,6 +3,7 @@ namespace Statamic\Http\Middleware\CP; use Closure; +use Statamic\Facades\CP\Toast; use Statamic\Facades\User; class RedirectIfAuthorized @@ -17,7 +18,13 @@ class RedirectIfAuthorized public function handle($request, Closure $next, $guard = null) { if ($user = User::current()) { - return redirect($user->can('access cp') ? cp_route('index') : '/'); + if ($user->can('access cp')) { + Toast::error(__('You can\'t do this while logged in')); + + return redirect(cp_route('index')); + } + + return redirect('/'); } return $next($request); From 192262ce005bdce52db70a550e589e0603178b09 Mon Sep 17 00:00:00 2001 From: Duncan McClean Date: Thu, 23 Nov 2023 12:28:53 +0000 Subject: [PATCH 3/5] switch for double quotes --- src/Http/Middleware/CP/RedirectIfAuthorized.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/Http/Middleware/CP/RedirectIfAuthorized.php b/src/Http/Middleware/CP/RedirectIfAuthorized.php index e1f23222eb1..9880a487d5f 100644 --- a/src/Http/Middleware/CP/RedirectIfAuthorized.php +++ b/src/Http/Middleware/CP/RedirectIfAuthorized.php @@ -19,7 +19,7 @@ public function handle($request, Closure $next, $guard = null) { if ($user = User::current()) { if ($user->can('access cp')) { - Toast::error(__('You can\'t do this while logged in')); + Toast::error(__("You can't do this while logged in")); return redirect(cp_route('index')); } From c1193ec4bcf6a4bf7b34cce9acb23b8333978b9d Mon Sep 17 00:00:00 2001 From: Jason Varga Date: Mon, 27 Nov 2023 15:22:12 -0500 Subject: [PATCH 4/5] refactor ... - Use guard like in RedirectIfAuthenticated - Use guard guard clause (ha) so the bulky logic doesnt have to all sit in an conditional - Apply the flash message to both redirects. Maybe the frontend is using the session:error tag. --- src/Http/Middleware/CP/RedirectIfAuthorized.php | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/src/Http/Middleware/CP/RedirectIfAuthorized.php b/src/Http/Middleware/CP/RedirectIfAuthorized.php index 9880a487d5f..3058ec7791c 100644 --- a/src/Http/Middleware/CP/RedirectIfAuthorized.php +++ b/src/Http/Middleware/CP/RedirectIfAuthorized.php @@ -3,7 +3,7 @@ namespace Statamic\Http\Middleware\CP; use Closure; -use Statamic\Facades\CP\Toast; +use Illuminate\Support\Facades\Auth; use Statamic\Facades\User; class RedirectIfAuthorized @@ -17,16 +17,14 @@ class RedirectIfAuthorized */ public function handle($request, Closure $next, $guard = null) { - if ($user = User::current()) { - if ($user->can('access cp')) { - Toast::error(__("You can't do this while logged in")); + if (! Auth::guard($guard)->check()) { + return $next($request); + } - return redirect(cp_route('index')); - } + $user = User::current(); - return redirect('/'); - } + $url = $user->can('access cp') ? cp_route('index') : '/'; - return $next($request); + return redirect($url)->withError(__("You can't do this while logged in")); } } From 7ef32a7745038c799998d1a2d95c3c480417fe39 Mon Sep 17 00:00:00 2001 From: Jason Varga Date: Mon, 27 Nov 2023 15:22:23 -0500 Subject: [PATCH 5/5] Apply to the reset password controller --- src/Http/Controllers/ResetPasswordController.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/Http/Controllers/ResetPasswordController.php b/src/Http/Controllers/ResetPasswordController.php index 605dff90165..e2e63ca7e10 100644 --- a/src/Http/Controllers/ResetPasswordController.php +++ b/src/Http/Controllers/ResetPasswordController.php @@ -8,7 +8,7 @@ use Statamic\Auth\Passwords\PasswordReset; use Statamic\Auth\ResetsPasswords; use Statamic\Contracts\Auth\User; -use Statamic\Http\Middleware\RedirectIfAuthenticated; +use Statamic\Http\Middleware\CP\RedirectIfAuthorized; class ResetPasswordController extends Controller { @@ -16,7 +16,7 @@ class ResetPasswordController extends Controller public function __construct() { - $this->middleware(RedirectIfAuthenticated::class); + $this->middleware(RedirectIfAuthorized::class); } public function showResetForm(Request $request, $token = null)