| 148 |
lars |
1 |
<?php
|
|
|
2 |
|
|
|
3 |
namespace Illuminate\Session\Middleware;
|
|
|
4 |
|
|
|
5 |
use Closure;
|
|
|
6 |
use Illuminate\Auth\AuthenticationException;
|
|
|
7 |
use Illuminate\Contracts\Auth\Factory as AuthFactory;
|
|
|
8 |
use Illuminate\Contracts\Session\Middleware\AuthenticatesSessions;
|
|
|
9 |
|
|
|
10 |
class AuthenticateSession implements AuthenticatesSessions
|
|
|
11 |
{
|
|
|
12 |
/**
|
|
|
13 |
* The authentication factory implementation.
|
|
|
14 |
*
|
|
|
15 |
* @var \Illuminate\Contracts\Auth\Factory
|
|
|
16 |
*/
|
|
|
17 |
protected $auth;
|
|
|
18 |
|
|
|
19 |
/**
|
|
|
20 |
* Create a new middleware instance.
|
|
|
21 |
*
|
|
|
22 |
* @param \Illuminate\Contracts\Auth\Factory $auth
|
|
|
23 |
* @return void
|
|
|
24 |
*/
|
|
|
25 |
public function __construct(AuthFactory $auth)
|
|
|
26 |
{
|
|
|
27 |
$this->auth = $auth;
|
|
|
28 |
}
|
|
|
29 |
|
|
|
30 |
/**
|
|
|
31 |
* Handle an incoming request.
|
|
|
32 |
*
|
|
|
33 |
* @param \Illuminate\Http\Request $request
|
|
|
34 |
* @param \Closure $next
|
|
|
35 |
* @return mixed
|
|
|
36 |
*/
|
|
|
37 |
public function handle($request, Closure $next)
|
|
|
38 |
{
|
|
|
39 |
if (! $request->hasSession() || ! $request->user()) {
|
|
|
40 |
return $next($request);
|
|
|
41 |
}
|
|
|
42 |
|
|
|
43 |
if ($this->guard()->viaRemember()) {
|
|
|
44 |
$passwordHash = explode('|', $request->cookies->get($this->guard()->getRecallerName()))[2] ?? null;
|
|
|
45 |
|
|
|
46 |
if (! $passwordHash || $passwordHash != $request->user()->getAuthPassword()) {
|
|
|
47 |
$this->logout($request);
|
|
|
48 |
}
|
|
|
49 |
}
|
|
|
50 |
|
|
|
51 |
if (! $request->session()->has('password_hash_'.$this->auth->getDefaultDriver())) {
|
|
|
52 |
$this->storePasswordHashInSession($request);
|
|
|
53 |
}
|
|
|
54 |
|
|
|
55 |
if ($request->session()->get('password_hash_'.$this->auth->getDefaultDriver()) !== $request->user()->getAuthPassword()) {
|
|
|
56 |
$this->logout($request);
|
|
|
57 |
}
|
|
|
58 |
|
|
|
59 |
return tap($next($request), function () use ($request) {
|
|
|
60 |
if (! is_null($this->guard()->user())) {
|
|
|
61 |
$this->storePasswordHashInSession($request);
|
|
|
62 |
}
|
|
|
63 |
});
|
|
|
64 |
}
|
|
|
65 |
|
|
|
66 |
/**
|
|
|
67 |
* Store the user's current password hash in the session.
|
|
|
68 |
*
|
|
|
69 |
* @param \Illuminate\Http\Request $request
|
|
|
70 |
* @return void
|
|
|
71 |
*/
|
|
|
72 |
protected function storePasswordHashInSession($request)
|
|
|
73 |
{
|
|
|
74 |
if (! $request->user()) {
|
|
|
75 |
return;
|
|
|
76 |
}
|
|
|
77 |
|
|
|
78 |
$request->session()->put([
|
|
|
79 |
'password_hash_'.$this->auth->getDefaultDriver() => $request->user()->getAuthPassword(),
|
|
|
80 |
]);
|
|
|
81 |
}
|
|
|
82 |
|
|
|
83 |
/**
|
|
|
84 |
* Log the user out of the application.
|
|
|
85 |
*
|
|
|
86 |
* @param \Illuminate\Http\Request $request
|
|
|
87 |
* @return void
|
|
|
88 |
*
|
|
|
89 |
* @throws \Illuminate\Auth\AuthenticationException
|
|
|
90 |
*/
|
|
|
91 |
protected function logout($request)
|
|
|
92 |
{
|
|
|
93 |
$this->guard()->logoutCurrentDevice();
|
|
|
94 |
|
|
|
95 |
$request->session()->flush();
|
|
|
96 |
|
|
|
97 |
throw new AuthenticationException('Unauthenticated.', [$this->auth->getDefaultDriver()]);
|
|
|
98 |
}
|
|
|
99 |
|
|
|
100 |
/**
|
|
|
101 |
* Get the guard instance that should be used by the middleware.
|
|
|
102 |
*
|
|
|
103 |
* @return \Illuminate\Contracts\Auth\Factory|\Illuminate\Contracts\Auth\Guard
|
|
|
104 |
*/
|
|
|
105 |
protected function guard()
|
|
|
106 |
{
|
|
|
107 |
return $this->auth;
|
|
|
108 |
}
|
|
|
109 |
}
|