confirmPassword() already checked the right account per guard, but the session marker it stamped, auth.password_confirmed_at, was one flat key shared by every guard. In shared-host mode the portal and console guards keep their login in the same session, so confirming a customer's portal password left the marker in place for an operator-only gate too. One private method now computes the key for all three callers so they cannot drift apart again. |
||
|---|---|---|
| .. | ||
| BuildsRunSteps.php | ||
| ChangesOwnPassword.php | ||
| ConfirmsPassword.php | ||
| ResolvesCustomer.php | ||