fix controllo password per operazioni protette. closes #351

Author: madbob

code/app/Http/Controllers/CommonsController.php

@@ -3,7 +3,7 @@
 namespace App\Http\Controllers;
 
 use Illuminate\Http\Request;
-use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Hash;
 
 class CommonsController extends Controller
 {
@@ -43,12 +43,13 @@ public function postVerify(Request $request)
     {
         $password = $request->input('password');
         $user = $request->user();
-        $test = Auth::attempt(['username' => $user->username, 'password' => $password]);
-        if ($test) {
-            return 'ok';
+
+        if (!Hash::check($password, $user->password)) {
+            return 'ko';
         }
         else {
-            return 'ko';
+            $request->session()->passwordConfirmed();
+            return 'ok';
         }
     }
 }

code/app/Http/Kernel.php

@@ -63,6 +63,7 @@ class Kernel extends HttpKernel
         'can' => \Illuminate\Auth\Middleware\Authorize::class,
         'guest' => \App\Http\Middleware\RedirectIfAuthenticated::class,
         'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class,
+        'password.confirm' => \Illuminate\Auth\Middleware\RequirePassword::class,
         'nodebugbar' => \App\Http\Middleware\DisableDebugBar::class,
     ];
 }

code/composer.json

@@ -12,7 +12,6 @@
         "barryvdh/laravel-debugbar": "^3.8",
         "barryvdh/laravel-dompdf": "^3.0.0",
         "barryvdh/laravel-translation-manager": "^0.6.8",
-        "php-feed-io/feed-io": "^6.0",
         "eluceo/ical": "^2.0",
         "genealabs/laravel-model-caching": "^12.0",
         "haydenpierce/class-finder": "^0.5.3",
@@ -23,11 +22,13 @@
         "madbob/larastrap": "^1.0",
         "madbob/laravel-queue-loopback": "^0.7.0",
         "pda/pheanstalk": "~4.0",
+        "php-feed-io/feed-io": "^6.0",
         "satispay/gbusiness-api-php-sdk": "^1.3",
         "spatie/db-dumper": "^3.0",
         "symfony/http-client": "^6.2",
         "symfony/psr-http-message-bridge": "^7.2",
-        "symfony/scaleway-mailer": "^7.0"
+        "symfony/scaleway-mailer": "^7.0",
+        "symfony/webhook": "^8.0"
     },
     "require-dev": {
         "brianium/paratest": "^7.2",

code/resources/assets/js/password.js

@@ -2,11 +2,13 @@ import utils from "./utils";
 
 $(document).ready(function() {
     $('body').on('click', '.password-field .bi-eye-slash', function() {
-        var i = $(this).closest('.password-field').find('input[type!=hidden]');
-        if (i.attr('type') == 'password')
+        let i = $(this).closest('.password-field').find('input[type!=hidden]');
+        if (i.attr('type') == 'password') {
             i.attr('type', 'text');
-        else
+        }
+        else {
             i.attr('type', 'password');
+        }
 
         $(this).toggleClass('bi-eye').toggleClass('bi-eye-close');
     });
@@ -19,10 +21,10 @@ $(document).ready(function() {
             appendTo = '#' + modal.attr('id');
         }
 
-        var input = $(this);
+        let input = $(this);
         input.popover({
             content: function() {
-                var ret = `<div>
+                let ret = `<div>
                 <div class="row mb-2"><label for="password" class="col-4 col-form-label">${_('texts.auth.password')}</label><div class="col-8"><input type="password" class="form-control" name="password" value="" autocomplete="off" minlength="8"></div></div>
                     <div class="row mb-2"><label for="password_confirm" class="col-4 col-form-label">${_('texts.auth.confirm_password')}</label><div class="col-8"><input type="password" class="form-control" name="password_confirm" value="" autocomplete="off" minlength="8"></div></div>`;
 
@@ -37,12 +39,12 @@ $(document).ready(function() {
                 ret.find('button.btn-success').click(function(e) {
                     e.preventDefault();
                     e.stopPropagation();
-                    var password = ret.find('input[name=password]').val();
-                    var confirm = ret.find('input[name=password_confirm]').val();
+                    let password = ret.find('input[name=password]').val();
+                    let confirm = ret.find('input[name=password_confirm]').val();
 
                     if (password == confirm) {
                         if (ret.find('input[name=enforce_change]').length != 0) {
-                            var enforce = ret.find('input[name=enforce_change]').prop('checked') ? 'true' : 'false';
+                            let enforce = ret.find('input[name=enforce_change]').prop('checked') ? 'true' : 'false';
                             input.closest('.input-group').find('input[name=enforce_password_change]').val(enforce);
                         }
 
@@ -77,7 +79,7 @@ $(document).ready(function() {
 
     $('body').on('submit', '#password-protection-dialog form', function(event) {
         event.preventDefault();
-        var modal = $(this).closest('.modal');
+        let modal = $(this).closest('.modal');
 
         $.ajax({
             method: 'POST',
@@ -87,15 +89,15 @@ $(document).ready(function() {
             },
             success: function(data) {
                 modal.modal('hide');
-                var target = modal.attr('data-form-target');
-                var form = $(target);
+                let target = modal.attr('data-form-target');
+                let form = $(target);
 
                 if (data == 'ok') {
                     form.attr('data-password-protected-verified', '1');
                     form.submit();
                 }
                 else {
-                    var save_button = form.find('button:submit');
+                    let save_button = utils.j().submitButton(form);
                     utils.inlineFeedback(save_button, _('texts.auth.wrong'));
                 }
             }

code/resources/views/movement/status.blade.php

@@ -8,7 +8,7 @@
     @endif
 
     @if(get_class($obj) == 'App\Gas')
-        <x-larastrap::iform classes="form-inline iblock" id="recalculate-account" method="POST" :action="url('/movements/recalculate')" :buttons="[['attributes' => ['type' => 'submit'], 'color' => 'danger', 'label' => __('texts.movements.recalculate_balances')]]">
+        <x-larastrap::iform classes="form-inline iblock" id="recalculate-account" method="POST" route="movements.recalculate" :buttons="[['attributes' => ['type' => 'submit'], 'color' => 'danger', 'label' => __('texts.movements.recalculate_balances')]]">
             <input type="hidden" name="pre-saved-function" value="passwordProtected">
             <input type="hidden" name="post-saved-function" value="displayRecalculatedBalances">
         </x-larastrap::iform>
@@ -51,7 +51,7 @@
 
                 <hr>
 
-                <x-larastrap::iform id="close-balance" :action="url('/movements/close')">
+                <x-larastrap::iform id="close-balance" route="movements.close">
                     <input type="hidden" name="reload-whole-page" value="1">
                     <input type="hidden" name="pre-saved-function" value="passwordProtected">
                     <x-larastrap::datepicker name="date" defaults_now="true" tlabel="generic.closing_date" />

code/routes/web.php

@@ -181,11 +181,8 @@
         Route::get('movements/{targetid}/history', 'MovementsController@getHistory')->name('movements.history');
         Route::get('movements/history/details', 'MovementsController@getHistoryDetails')->name('movements.history.details');
         Route::get('movements/{targetid}/balance', 'MovementsController@getBalance')->name('movements.balance');
-        Route::post('movements/recalculate', 'MovementsController@recalculate');
-        Route::post('movements/close', 'MovementsController@closeBalance');
         Route::get('movements/askdelete/{id}', 'MovementsController@askDelete')->name('movements.askdelete');
         Route::get('movements/askdeletebalance/{id}', 'MovementsController@askDeleteBalance')->name('movements.askdeletebalance');
-        Route::post('movements/deletebalance/{id}', 'MovementsController@deleteBalance')->name('movements.deletebalance');
         Route::get('movements/document/{type}/{subtype?}', 'MovementsController@document');
 
         Route::get('movtypes/{id}/post_feedback', 'MovementTypesController@postFeedback')->name('movtypes.feedback');
@@ -196,6 +193,12 @@
         Route::get('import/gdxp', 'ImportController@getGdxp');
         Route::post('import/gdxp', 'ImportController@postGdxp');
 
+        Route::middleware('password.confirm')->group(function() {
+            Route::post('movements/recalculate', 'MovementsController@recalculate')->name('movements.recalculate');
+            Route::post('movements/close', 'MovementsController@closeBalance')->name('movements.close');
+            Route::post('movements/deletebalance/{id}', 'MovementsController@deleteBalance')->name('movements.deletebalance');
+        });
+
         Route::resource('gas', 'GasController');
         Route::resource('multigas', 'MultiGasController');
         Route::resource('users', 'UsersController');