Mirrors/invoiceninja
1
0
Fork 0
mirror of https://github.com/invoiceninja/invoiceninja.git synced 2024-11-05 18:52:44 +01:00
Code Issues Releases Activity

Allow circumvention of client portal passwords using designated hash

Browse Source
This commit is contained in:
David Bomba 2020-09-07 14:49:57 +10:00
parent d909b4939c
commit 18282acbd7
3 changed files with 31 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
app/Http/Controllers/ClientPortal/EntityViewController.php
View File

@ -33,17 +33,18 @@ class EntityViewController extends Controller
$key = $entity_type.'_id';
$invitation = $invitation_entity::whereRaw('BINARY `key`= ?', [$invitation_key])->firstOrFail();
$invitation = $invitation_entity::whereRaw('BINARY `key`= ?', [$invitation_key])
->with('contact.client')
->firstOrFail();
$contact = $invitation->contact;
$client = $contact->client;
$entity = $invitation->{$entity_type};
if (is_null($contact->password) || empty($contact->password)) {
return redirect("/client/password/reset?email={$contact->email}");
}
$entity_class = sprintf('App\\Models\\%s', ucfirst($entity_type));
$entity = $entity_class::findOrFail($invitation->{$key});
if ((bool) $invitation->contact->client->getSetting('enable_client_portal_password') !== false) {
session()->flash("{$entity_type}_VIEW_{$entity->hashed_id}", true);
}

45
app/Http/Controllers/ClientPortal/InvitationController.php
View File

@ -37,29 +37,34 @@ class InvitationController extends Controller
$entity_obj = 'App\Models\\'.ucfirst($entity).'Invitation';
$invitation = $entity_obj::whereRaw('BINARY `key`= ?', [$invitation_key])->first();
$invitation = $entity_obj::whereRaw('BINARY `key`= ?', [$invitation_key])
->with('contact.client')
->firstOrFail();
if ($invitation) {
if ((bool) $invitation->contact->client->getSetting('enable_client_portal_password') !== false) {
$this->middleware('auth:contact');
} else {
auth()->guard('contact')->login($invitation->contact, true);
}
/* Return early if we have the correct client_hash embedded */
if (! request()->has('silent') && ! $invitation->viewed_date) {
// if (!request()->has('silent')) {
$invitation->markViewed();
event(new InvitationWasViewed($invitation->{$entity}, $invitation, $invitation->{$entity}->company, Ninja::eventVars()));
$this->fireEntityViewedEvent($invitation, $entity);
}
return redirect()->route('client.'.$entity.'.show', [$entity => $this->encodePrimaryKey($invitation->{$key})]);
} else {
abort(404);
if(request()->has('client_hash') && request()->input('client_hash') == $invitation->contact->client->client_hash) {
auth()->guard('contact')->login($invitation->contact, true);
}
else if ((bool) $invitation->contact->client->getSetting('enable_client_portal_password') !== false) {
$this->middleware('auth:contact');
}
else {
auth()->guard('contact')->login($invitation->contact, true);
}
if (auth()->guard('contact') && ! request()->has('silent') && ! $invitation->viewed_date) {
$invitation->markViewed();
event(new InvitationWasViewed($invitation->{$entity}, $invitation, $invitation->{$entity}->company, Ninja::eventVars()));
$this->fireEntityViewedEvent($invitation, $entity);
}
return redirect()->route('client.'.$entity.'.show', [$entity => $this->encodePrimaryKey($invitation->{$key})]);
}
private function fireEntityViewedEvent($invitation, $entity_string)

2
config/filesystems.php
View File

@ -13,7 +13,7 @@ return [
|
*/
'default' => env('FILESYSTEM_DRIVER', 'local'),
'default' => env('FILESYSTEM_DRIVER', 'public'),
/*
|--------------------------------------------------------------------------