From 68dc704ca0a760e01b7b44c1d21ccd9b49c1d06c Mon Sep 17 00:00:00 2001 From: Deon George Date: Sat, 19 Jun 2021 10:41:56 +1000 Subject: [PATCH] Logout in-active users and dont respond to resets or logins --- .../Auth/ForgotPasswordController.php | 22 +++++++++++++++ app/Http/Controllers/Auth/LoginController.php | 22 +++++++++++++++ app/Http/Kernel.php | 1 + app/Http/Middleware/ActiveUser.php | 27 +++++++++++++++++++ app/Models/User.php | 2 ++ resources/views/user/addedit.blade.php | 2 +- resources/views/user/home.blade.php | 8 +++--- routes/web.php | 2 +- 8 files changed, 81 insertions(+), 5 deletions(-) create mode 100644 app/Http/Middleware/ActiveUser.php diff --git a/app/Http/Controllers/Auth/ForgotPasswordController.php b/app/Http/Controllers/Auth/ForgotPasswordController.php index 465c39c..796e397 100644 --- a/app/Http/Controllers/Auth/ForgotPasswordController.php +++ b/app/Http/Controllers/Auth/ForgotPasswordController.php @@ -4,6 +4,8 @@ namespace App\Http\Controllers\Auth; use App\Http\Controllers\Controller; use Illuminate\Foundation\Auth\SendsPasswordResetEmails; +use Illuminate\Http\Request; +use Illuminate\Support\Facades\Password; class ForgotPasswordController extends Controller { @@ -19,4 +21,24 @@ class ForgotPasswordController extends Controller */ use SendsPasswordResetEmails; + + public function sendResetLinkEmail(Request $request) + { + $this->validateEmail($request); + + // If the account is not active, or doesnt exist, we'll send a fake "sent" message. + if (! ($x=$this->broker()->getUser($this->credentials($request))) || (! $x->active)) + return $this->sendResetLinkResponse($request, Password::RESET_LINK_SENT); + + // We will send the password reset link to this user. Once we have attempted + // to send the link, we will examine the response then see the message we + // need to show to the user. Finally, we'll send out a proper response. + $response = $this->broker()->sendResetLink( + $this->credentials($request) + ); + + return $response == Password::RESET_LINK_SENT + ? $this->sendResetLinkResponse($request, $response) + : $this->sendResetLinkFailedResponse($request, $response); + } } diff --git a/app/Http/Controllers/Auth/LoginController.php b/app/Http/Controllers/Auth/LoginController.php index 0959645..60ed36f 100644 --- a/app/Http/Controllers/Auth/LoginController.php +++ b/app/Http/Controllers/Auth/LoginController.php @@ -4,7 +4,10 @@ namespace App\Http\Controllers\Auth; use App\Http\Controllers\Controller; use App\Providers\RouteServiceProvider; +use Carbon\Carbon; use Illuminate\Foundation\Auth\AuthenticatesUsers; +use Illuminate\Http\Request; +use Illuminate\Support\Facades\Auth; class LoginController extends Controller { @@ -38,6 +41,25 @@ class LoginController extends Controller $this->middleware('guest')->except('logout'); } + public function login(Request $request) + { + $this->validateLogin($request); + + if (Auth::attempt(array_merge($this->credentials($request),['active'=>TRUE]))) { + $request->session()->regenerate(); + + return $this->sendLoginResponse($request); + } + + return $this->sendFailedLoginResponse($request); + } + + protected function authenticated(Request $request, $user) + { + $user->last_on = Carbon::now(); + $user->save(); + } + /** * Show our themed login page */ diff --git a/app/Http/Kernel.php b/app/Http/Kernel.php index 9491962..037f28a 100644 --- a/app/Http/Kernel.php +++ b/app/Http/Kernel.php @@ -51,6 +51,7 @@ class Kernel extends HttpKernel * @var array */ protected $routeMiddleware = [ + 'activeuser' => \App\Http\Middleware\ActiveUser::class, 'auth' => \App\Http\Middleware\Authenticate::class, 'auth.basic' => \Illuminate\Auth\Middleware\AuthenticateWithBasicAuth::class, 'bindings' => \Illuminate\Routing\Middleware\SubstituteBindings::class, diff --git a/app/Http/Middleware/ActiveUser.php b/app/Http/Middleware/ActiveUser.php new file mode 100644 index 0000000..d333df1 --- /dev/null +++ b/app/Http/Middleware/ActiveUser.php @@ -0,0 +1,27 @@ +exists && ! Auth::user()->active) { + Auth::logout(); + abort(403,'Your account is not active'); + } + + return $next($request); + } +} diff --git a/app/Models/User.php b/app/Models/User.php index a481d17..00cfcd5 100644 --- a/app/Models/User.php +++ b/app/Models/User.php @@ -40,4 +40,6 @@ class User extends Authenticatable implements MustVerifyEmail protected $casts = [ 'email_verified_at' => 'datetime', ]; + + protected $dates = ['last_on']; } diff --git a/resources/views/user/addedit.blade.php b/resources/views/user/addedit.blade.php index 5d8738d..24d0647 100644 --- a/resources/views/user/addedit.blade.php +++ b/resources/views/user/addedit.blade.php @@ -87,7 +87,7 @@
- Cancel + Cancel @can('admin',$o) @endcan diff --git a/resources/views/user/home.blade.php b/resources/views/user/home.blade.php index fd9f260..1c01ab8 100644 --- a/resources/views/user/home.blade.php +++ b/resources/views/user/home.blade.php @@ -5,7 +5,7 @@ @section('content')
-
+

Current Users:

@@ -13,6 +13,7 @@ + @@ -21,7 +22,7 @@ @can('admin',(new \App\Models\User)) - + @endcan @foreach (\App\Models\User::orderBy('email')->cursor() as $oo) @@ -29,8 +30,9 @@ + - + @endforeach diff --git a/routes/web.php b/routes/web.php index bd3dba4..11ee269 100644 --- a/routes/web.php +++ b/routes/web.php @@ -30,7 +30,7 @@ Route::get('logout',[LoginController::class,'logout']); Route::redirect('/','about'); Route::view('about','about'); -Route::middleware(['verified'])->group(function () { +Route::middleware(['verified','activeuser'])->group(function () { Route::get('ftn/domain',[DomainController::class,'home']); Route::match(['get','post'],'ftn/domain/addedit/{o?}',[DomainController::class,'add_edit']) ->where('o','[0-9]+');
ID Email NameActive Verified Last On
Add New UserAdd New User
{{ $oo->id }} {{ $oo->email }} {{ $oo->name }}{{ $oo->active ? 'YES' : 'NO' }} {{ $oo->email_verified_at ? $oo->email_verified_at->format('Y-m-d') : '-' }}{{-- $oo->last_on --}}TBA{{ $oo->last_on ? $oo->last_on->toDateTimeString() : 'Unknown' }}