myth-auth
myth-auth copied to clipboard
AuthController should use $reservedRoutes config variables in named route redirects
Now Myth:Auth uses $reservedRoutes config variable to generate content of Myth's routes.php file and users can customize it.
In AuthController.php file we can find many redirects to the named routes, like
return redirect()->to(route_to('reset-password')
inside attemptLogin() method
return redirect()->route('login')->with('message', lang('Auth.activationSuccess'));
inside attemptRegister() method
return redirect()->route('login')->with('error', lang('Auth.forgotDisabled'));
inside forgotPassword() method
return redirect()->route('reset-password')->with('message', lang('Auth.forgotEmailSent'));
inside attemptForgot() method
return redirect()->route('login')->with('error', lang('Auth.forgotDisabled'));
inside resetPassword() method and so on.
So all this will work well until user customize $reservedRoutes config variable. For example if user changes default
public $reservedRoutes = [
'login' => 'login',
// ...
'reset-password' => 'reset-password',
];
to
public $reservedRoutes = [
'login' => 'myth-login',
// ...
'reset-password' => 'change-password',
];
then the above listed named route redirects with redirect()->route('login')
and redirect()->route('reset-password')
will fail.
I think all use cases should be replaced with $reservedRoutes config values.
Or am i missing something?
I believe you are correct. The configurable routes was a recent addition and not the most thoroughly checked.
Worked on it! Thank you @manageruz