extern/2FAuth
1
0
Fork 0
mirror of https://github.com/Bubka/2FAuth.git synced 2025-02-17 02:41:13 +01:00
Code Issues Packages Projects Releases Wiki Activity

Prevent last admin deletion & Update the Delete user feature

Browse Source
This commit is contained in:
Bubka 2023-03-10 16:02:56 +01:00
parent fd6941d300
commit 4753401827
2 changed files with 19 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
app/Http/Controllers/Auth/UserController.php
View File

@ -6,7 +6,7 @@
use App\Http\Controllers\Controller; use App\Http\Controllers\Controller;
use App\Http\Requests\UserDeleteRequest; use App\Http\Requests\UserDeleteRequest;
use App\Http\Requests\UserUpdateRequest; use App\Http\Requests\UserUpdateRequest;
use Illuminate\Support\Facades\Artisan; use App\Models\User;
use Illuminate\Support\Facades\Auth; use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\DB; use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\Hash; use Illuminate\Support\Facades\Hash;
@ -51,40 +51,38 @@ public function update(UserUpdateRequest $request)
public function delete(UserDeleteRequest $request) public function delete(UserDeleteRequest $request)
{ {
$validated = $request->validated(); $validated = $request->validated();
$user = Auth::user();
Log::info(sprintf('Deletion of user ID #%s requested', $validated['user_id'])); Log::info(sprintf('Deletion of user ID #%s requested', $user->id));
if ($user->is_admin && User::admins()->count() == 1) {
return response()->json(['message' => __('errors.cannot_delete_the_only_admin')], 400);
}
if (! Hash::check($validated['password'], Auth::user()->password)) { if (! Hash::check($validated['password'], Auth::user()->password)) {
return response()->json(['message' => __('errors.wrong_current_password')], 400); return response()->json(['message' => __('errors.wrong_current_password')], 400);
} }
try { try {
DB::transaction(function () { DB::transaction(function () use ($user) {
DB::table('twofaccounts')->delete(); DB::table('twofaccounts')->where('user_id', $user->id)->delete();
DB::table('groups')->delete(); DB::table('groups')->where('user_id', $user->id)->delete();
DB::table('options')->delete(); DB::table('webauthn_credentials')->where('authenticatable_id', $user->id)->delete();
DB::table('webauthn_credentials')->delete(); DB::table('webauthn_recoveries')->where('email', $user->email)->delete();
DB::table('webauthn_recoveries')->delete(); DB::table('oauth_access_tokens')->where('user_id', $user->id)->delete();
DB::table('oauth_access_tokens')->delete(); DB::table('password_resets')->where('email', $user->email)->delete();
DB::table('oauth_auth_codes')->delete(); DB::table('users')->where('id', $user->id)->delete();
DB::table('oauth_clients')->delete();
DB::table('oauth_personal_access_clients')->delete();
DB::table('oauth_refresh_tokens')->delete();
DB::table('password_resets')->delete();
DB::table('users')->delete();
}); });
Artisan::call('passport:install --force');
Artisan::call('config:clear');
} }
// @codeCoverageIgnoreStart // @codeCoverageIgnoreStart
catch (\Throwable $e) { catch (\Throwable $e) {
Log::error('User deletion failed'); Log::error(sprintf('Deletion of user ID #%s failed, transaction has been rolled-back', $user->id));
return response()->json(['message' => __('errors.user_deletion_failed')], 400); return response()->json(['message' => __('errors.user_deletion_failed')], 400);
} }
// @codeCoverageIgnoreEnd // @codeCoverageIgnoreEnd
Log::info(sprintf('User ID #%s deleted', $validated['user_id']));
Log::info(sprintf('User ID #%s deleted', $user->id));
return response()->json(null, 204); return response()->json(null, 204);
} }

1
resources/lang/en/errors.php
View File

@ -51,4 +51,5 @@
'file_upload_failed' => 'File upload failed', 'file_upload_failed' => 'File upload failed',
'unauthorized' => 'Unauthorized', 'unauthorized' => 'Unauthorized',
'unauthorized_legend' => 'You do not have permissions to view this resource or to perform this action', 'unauthorized_legend' => 'You do not have permissions to view this resource or to perform this action',
'cannot_delete_the_only_admin' => 'Cannot delete the only admin account'
]; ];