miguel456/athenahr
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: prevent forced password reset for passwordless users

Browse Source 
Signed-off-by: miguel456 <me@nogueira.codes>
This commit is contained in:
Miguel Nogueira 2022-10-21 07:47:03 +01:00
parent c6bc4da41c
commit cfdc0eb37b
No known key found for this signature in database
GPG Key ID: 3C6A7E29AF26D370
2 changed files with 41 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
app/Http/Controllers/UserController.php
View File

@ -358,20 +358,27 @@ class UserController extends Controller
public function forcePasswordReset(User $user) { public function forcePasswordReset(User $user) {
$this->authorize('adminEdit', $user); $this->authorize('adminEdit', $user);
$user->notify(new PasswordAdminResetNotification());
$user->password = null; if (!$user->hasPassword()) {
$user->save(); $user->notify(new PasswordAdminResetNotification());
$user->password = null;
$user->save();
Log::alert("Removed account password", [ Log::alert("Removed account password", [
'target' => $user, 'target' => $user,
'actor' => Auth::user() 'actor' => Auth::user()
]); ]);
return redirect()
->back()
->with('success', __('Account password removed.'));
}
return redirect() return redirect()
->back() ->back()
->with('success', 'Account password removed.'); ->with('error', __('This user doesn\'t have a password to reset.'));
} }

44
resources/views/dashboard/user/manage.blade.php
View File

@ -43,29 +43,31 @@
@endif @endif
<x-modal id="resetAccountPasswordModal" modal-label="resetAccountPassword" modal-title="{{ __('Verify your identity') }}" include-close-button="true"> @if($user->hasPassword())
<x-modal id="resetAccountPasswordModal" modal-label="resetAccountPassword" modal-title="{{ __('Verify your identity') }}" include-close-button="true">
<p>{{ __('Forcing a password reset will automatically notify the account holder and send them a password reset link. Please confirm this action by verifying your identity below.') }}</p> <p>{{ __('Forcing a password reset will automatically notify the account holder and send them a password reset link. Please confirm this action by verifying your identity below.') }}</p>
<form id="resetAccountPasswordForm" method="POST" action="{{ route('force-reset-user', ['user' => $user]) }}"> <form id="resetAccountPasswordForm" method="POST" action="{{ route('force-reset-user', ['user' => $user]) }}">
@csrf @csrf
@method('patch') @method('patch')
<x-confirm-password> <x-confirm-password>
{{ __('Re-entering your password is required to confirm sensitive administration actions.') }} {{ __('Re-entering your password is required to confirm sensitive administration actions.') }}
</x-confirm-password> </x-confirm-password>
<x-confirm-second-factor> <x-confirm-second-factor>
{{ __('Two-factor authentication is required to confirm sensitive administration actions.') }} {{ __('Two-factor authentication is required to confirm sensitive administration actions.') }}
</x-confirm-second-factor> </x-confirm-second-factor>
</form> </form>
<x-slot name="modalFooter"> <x-slot name="modalFooter">
<button onclick="$('#resetAccountPasswordForm').submit()" type="button" class="btn btn-warning"><i class="fas fa-check"></i> {{ __('Re-authenticate and verify') }}</button> <button onclick="$('#resetAccountPasswordForm').submit()" type="button" class="btn btn-warning"><i class="fas fa-check"></i> {{ __('Re-authenticate and verify') }}</button>
</x-slot> </x-slot>
</x-modal> </x-modal>
@endif
<x-modal id="banAccountModal" modal-label="banAccount" modal-title="{{__('Please confirm')}}" include-close-button="true"> <x-modal id="banAccountModal" modal-label="banAccount" modal-title="{{__('Please confirm')}}" include-close-button="true">
@ -413,7 +415,7 @@
</x-alert> </x-alert>
@endif @endif
@if (!$isSuspended) @if (!$isSuspended)
<button onclick="$('#banAccountModal').modal('show')" type="button" class="btn btn-warning mr-3"><i class="fas fa-user-slash"></i> {{ __('Suspend account') }}</button> <button onclick="$('#banAccountModal').modal('show')" type="button" class="btn btn-warning mr-3"><i class="fas fa-user-slash"></i> {{ __('Suspend account') }}</button>
@else @else
<form class="d-inline" method="post" action="{{ route('unbanUser', ['user' => $user]) }}"> <form class="d-inline" method="post" action="{{ route('unbanUser', ['user' => $user]) }}">
@ -423,7 +425,13 @@
<button type="submit" class="btn btn-success mr-2"><i class="fas fa-user"></i> {{ __('Unsuspend account') }}</button> <button type="submit" class="btn btn-success mr-2"><i class="fas fa-user"></i> {{ __('Unsuspend account') }}</button>
</form> </form>
@endif @endif
<button onclick="$('#resetAccountPasswordModal').modal('show')" class="btn-danger btn mr-3" type="button"><i class="fas fa-key"></i> {{ __('Force password reset') }}</button>
@if($user->hasPassword())
<button onclick="$('#resetAccountPasswordModal').modal('show')" class="btn-danger btn mr-3" type="button"><i class="fas fa-key"></i> {{ __('Force password reset') }}</button>
@else
<button disabled class="btn-danger btn mr-3" type="button"><i class="fas fa-key"></i> {{ __('Force password reset') }}</button>
@endif
@if($user->has2FA()) @if($user->has2FA())
<button onclick="$('#resetTwoFactorModal').modal('show')" class="btn-danger btn mr-3" type="button"><i class="fas fa-unlock"></i> {{ __('Reset MFA') }}</button> <button onclick="$('#resetTwoFactorModal').modal('show')" class="btn-danger btn mr-3" type="button"><i class="fas fa-unlock"></i> {{ __('Reset MFA') }}</button>
@endif @endif