mirror of
https://github.com/flarum/framework.git
synced 2025-05-22 06:39:57 +08:00
9896378b59
- Use cookies + CSRF token for API authentication in the default client. This mitigates potential XSS attacks by making the token unavailable to JavaScript. The Authorization header is still supported, but not used by default. - Make sensitive/destructive actions (editing a user, permanently deleting anything, visiting the admin CP) require the user to re-enter their password if they haven't entered it in the last 30 minutes. - Refactor and clean up the authentication middleware. - Add an `onhide` hook to the Modal component. (+1 squashed commit)
66 lines
1.7 KiB
PHP
66 lines
1.7 KiB
PHP
<?php
|
|
/*
|
|
* This file is part of Flarum.
|
|
*
|
|
* (c) Toby Zerner <toby.zerner@gmail.com>
|
|
*
|
|
* For the full copyright and license information, please view the LICENSE
|
|
* file that was distributed with this source code.
|
|
*/
|
|
|
|
namespace Flarum\Forum\Controller;
|
|
|
|
use Flarum\Core\Command\ConfirmEmail;
|
|
use Flarum\Core\Exception\InvalidConfirmationTokenException;
|
|
use Flarum\Foundation\Application;
|
|
use Flarum\Http\Controller\ControllerInterface;
|
|
use Illuminate\Contracts\Bus\Dispatcher;
|
|
use Psr\Http\Message\ServerRequestInterface as Request;
|
|
use Zend\Diactoros\Response\HtmlResponse;
|
|
use Zend\Diactoros\Response\RedirectResponse;
|
|
|
|
class ConfirmEmailController implements ControllerInterface
|
|
{
|
|
/**
|
|
* @var Dispatcher
|
|
*/
|
|
protected $bus;
|
|
|
|
/**
|
|
* @var Application
|
|
*/
|
|
protected $app;
|
|
|
|
/**
|
|
* @param Dispatcher $bus
|
|
* @param Application $app
|
|
*/
|
|
public function __construct(Dispatcher $bus, Application $app)
|
|
{
|
|
$this->bus = $bus;
|
|
$this->app = $app;
|
|
}
|
|
|
|
/**
|
|
* @param Request $request
|
|
* @return \Psr\Http\Message\ResponseInterface
|
|
*/
|
|
public function handle(Request $request)
|
|
{
|
|
try {
|
|
$token = array_get($request->getQueryParams(), 'token');
|
|
|
|
$user = $this->bus->dispatch(
|
|
new ConfirmEmail($token)
|
|
);
|
|
} catch (InvalidConfirmationTokenException $e) {
|
|
return new HtmlResponse('Invalid confirmation token');
|
|
}
|
|
|
|
$session = $request->getAttribute('session');
|
|
$session->assign($user)->regenerateId()->renew()->setDuration(60 * 24 * 14)->save();
|
|
|
|
return new RedirectResponse($this->app->url());
|
|
}
|
|
}
|