278c4b9953
The setup-route exemption already went through AdminArea::routeIs(),
which matches both admin.<name> and admin.via*.<name>. The logout
exemption next to it used a bare $request->routeIs('admin.logout'),
which matches only the canonical name — on a recovery hostname the
logout route is admin.via0.logout, so the check failed there and an
unenrolled operator's logout POST bounced back to enrolment instead
of being let through, on exactly the host that exists because the
canonical one is not working.
|
||
|---|---|---|
| .. | ||
| EnsureAdmin.php | ||
| EnsureCustomerActive.php | ||
| PublicSiteGate.php | ||
| RequireOperatorTwoFactor.php | ||
| RestrictAdminHost.php | ||
| RestrictConsoleNetwork.php | ||