68 lines
2.4 KiB
PHP
68 lines
2.4 KiB
PHP
<?php
|
|
|
|
namespace App\Livewire\Concerns;
|
|
|
|
use App\Actions\Fortify\UpdateUserPassword;
|
|
use Illuminate\Support\Facades\Hash;
|
|
use Illuminate\Validation\ValidationException;
|
|
|
|
/**
|
|
* Changing your own password, from wherever you are signed in.
|
|
*
|
|
* There was no way to do it at all: Fortify's updatePasswords feature was off,
|
|
* so an account created with a generated password kept it until someone opened
|
|
* a shell on the server. Shared by the console and the customer portal because
|
|
* the rules are the same in both, and having two copies of a password rule is
|
|
* how one of them ends up weaker.
|
|
*
|
|
* Goes through Fortify's own action rather than hashing here, so the password
|
|
* rules stay in the single place that already defines them.
|
|
*/
|
|
trait ChangesOwnPassword
|
|
{
|
|
public string $currentPassword = '';
|
|
|
|
public string $newPassword = '';
|
|
|
|
public string $newPasswordConfirmation = '';
|
|
|
|
public function updateOwnPassword(): void
|
|
{
|
|
// The current password is asked for, and checked here as well as in the
|
|
// action: an attacker on an unlocked machine should not be able to lock
|
|
// the owner out of their own account with two keystrokes.
|
|
$this->validate([
|
|
'currentPassword' => 'required|string',
|
|
'newPassword' => 'required|string',
|
|
'newPasswordConfirmation' => 'required|string',
|
|
]);
|
|
|
|
if (! Hash::check($this->currentPassword, auth()->user()->password)) {
|
|
$this->addError('currentPassword', __('admin_settings.password_wrong'));
|
|
|
|
return;
|
|
}
|
|
|
|
try {
|
|
app(UpdateUserPassword::class)->update(auth()->user(), [
|
|
'current_password' => $this->currentPassword,
|
|
'password' => $this->newPassword,
|
|
'password_confirmation' => $this->newPasswordConfirmation,
|
|
]);
|
|
} catch (ValidationException $e) {
|
|
foreach ($e->errors() as $field => $messages) {
|
|
$this->addError(match ($field) {
|
|
'current_password' => 'currentPassword',
|
|
'password' => 'newPassword',
|
|
default => $field,
|
|
}, $messages[0]);
|
|
}
|
|
|
|
return;
|
|
}
|
|
|
|
$this->reset('currentPassword', 'newPassword', 'newPasswordConfirmation');
|
|
$this->dispatch('notify', message: __('admin_settings.password_changed'));
|
|
}
|
|
}
|