From 0ab5b96a008c6e8bccbc53f37f24fe3732de25e7 Mon Sep 17 00:00:00 2001 From: Daniel Supernault Date: Wed, 26 Apr 2023 03:10:06 -0600 Subject: [PATCH] Update ResetPasswordController, add captcha support, improve security and a new redesigned view --- .../Auth/ResetPasswordController.php | 73 +++++++ .../views/auth/passwords/reset.blade.php | 196 +++++++++++++----- 2 files changed, 216 insertions(+), 53 deletions(-) diff --git a/app/Http/Controllers/Auth/ResetPasswordController.php b/app/Http/Controllers/Auth/ResetPasswordController.php index 23d3c2821..a92c4e38d 100644 --- a/app/Http/Controllers/Auth/ResetPasswordController.php +++ b/app/Http/Controllers/Auth/ResetPasswordController.php @@ -7,6 +7,7 @@ use Illuminate\Foundation\Auth\ResetsPasswords; use Illuminate\Support\Facades\Password; use Illuminate\Http\Request; use App\Services\BouncerService; +use Illuminate\Validation\Rules; class ResetPasswordController extends Controller { @@ -40,6 +41,46 @@ class ResetPasswordController extends Controller $this->middleware('guest'); } + /** + * Get the password reset validation rules. + * + * @return array + */ + protected function rules() + { + usleep(random_int(100000, 3000000)); + + if(config('captcha.enabled')) { + return [ + 'token' => 'required', + 'email' => 'required|email', + 'password' => ['required', 'confirmed', 'max:72', Rules\Password::defaults()], + 'h-captcha-response' => ['required' ,'filled', 'captcha'] + ]; + } + + return [ + 'token' => 'required', + 'email' => 'required|email', + 'password' => ['required', 'confirmed', 'max:72', Rules\Password::defaults()], + ]; + } + + /** + * Get the password reset validation error messages. + * + * @return array + */ + protected function validationErrorMessages() + { + return [ + 'password.max' => 'Passwords should not exceed 72 characters.', + 'h-captcha-response.required' => 'Failed to validate the captcha.', + 'h-captcha-response.filled' => 'Failed to validate the captcha.', + 'h-captcha-response.captcha' => 'Failed to validate the captcha.', + ]; + } + /** * Display the password reset view for the given token. * @@ -54,6 +95,8 @@ class ResetPasswordController extends Controller abort_if(BouncerService::checkIp($request->ip()), 404); } + usleep(random_int(100000, 300000)); + $token = $request->route()->parameter('token'); return view('auth.passwords.reset')->with( @@ -86,4 +129,34 @@ class ResetPasswordController extends Controller : $this->sendResetFailedResponse($request, $response); } + /** + * Get the password reset credentials from the request. + * + * @param \Illuminate\Http\Request $request + * @return array + */ + protected function credentials(Request $request) + { + return $request->only( + 'email', 'password', 'password_confirmation', 'token' + ); + } + + /** + * Get the response for a failed password reset. + * + * @param \Illuminate\Http\Request $request + * @param string $response + * @return \Illuminate\Http\RedirectResponse|\Illuminate\Http\JsonResponse + */ + protected function sendResetFailedResponse(Request $request, $response) + { + if ($request->wantsJson()) { + throw ValidationException::withMessages(['email' => [trans($response)]]); + } + return redirect()->back() + ->withInput($request->only('email')) + ->withErrors(['email' => [trans($response)]]); + } + } diff --git a/resources/views/auth/passwords/reset.blade.php b/resources/views/auth/passwords/reset.blade.php index e160f2109..efe59ac95 100644 --- a/resources/views/auth/passwords/reset.blade.php +++ b/resources/views/auth/passwords/reset.blade.php @@ -1,64 +1,154 @@ -@extends('layouts.app') +@extends('layouts.blank') + +@push('styles') + + +@endpush @section('content') -
-
-
-
-
{{ __('Reset Password') }}
+
+
+
+
+
+ + + +

Reset Password

+

Use this form to reset your password.

+
-
-
- @csrf + @if ($errors) + @foreach($errors as $error) + + {{ $error }} + + @endforeach + @endif - +
+
{{ __('Reset Password') }}
-
-
- - @if ($errors->has('email')) - - {{ $errors->first('email') }} - - @endif -
-
-
-
-
- +
+ + @csrf - @if ($errors->has('password')) - - {{ $errors->first('password') }} - - @endif -
-
+ + -
-
- +
+
+ + - @if ($errors->has('password_confirmation')) - - {{ $errors->first('password_confirmation') }} - - @endif -
-
+ @if ($errors->has('email')) + + {{ $errors->first('email') }} + + @endif +
+
-
-
- -
-
- -
-
-
-
+
+ +
+
+ + + + + @if ($errors->has('password')) + + {{ $errors->first('password') }} + + @else +

Enter a new password between {{config('pixelfed.min_password_length')}}-72 characters long.

+ @endif +
+
+ +
+
+ + + + + @if ($errors->has('password_confirmation')) + + {{ $errors->first('password_confirmation') }} + + @endif +
+
+ + @if(config('captcha.enabled')) + +
+ {!! Captcha::display(['data-theme' => 'dark']) !!} +
+ @if ($errors->has('h-captcha-response')) +
+ {{ $errors->first('h-captcha-response') }} +
+ @endif + @endif + +
+
+ +
+
+ +
+
+
+
+
@endsection + +@push('scripts') + +@endpush