b3256d4df1
Restrict mass-assignable attributes across user/team/redis models and switch privileged root/team creation paths to forceFill/forceCreate. Encrypt legacy ClickHouse admin passwords via migration and cast the correct ClickHouse password field as encrypted. Tighten API and runtime exposure by removing sensitive team fields from responses and sanitizing Git/compose error messages. Expand security-focused feature coverage for command-injection and mass assignment protections.
71 lines
2.2 KiB
PHP
71 lines
2.2 KiB
PHP
<?php
|
|
|
|
namespace App\Actions\Fortify;
|
|
|
|
use App\Models\User;
|
|
use Illuminate\Support\Facades\Hash;
|
|
use Illuminate\Support\Facades\Validator;
|
|
use Illuminate\Validation\Rule;
|
|
use Illuminate\Validation\Rules\Password;
|
|
use Laravel\Fortify\Contracts\CreatesNewUsers;
|
|
|
|
class CreateNewUser implements CreatesNewUsers
|
|
{
|
|
/**
|
|
* Validate and create a newly registered user.
|
|
*
|
|
* @param array<string, string> $input
|
|
*/
|
|
public function create(array $input): User
|
|
{
|
|
$settings = instanceSettings();
|
|
if (! $settings->is_registration_enabled) {
|
|
abort(403);
|
|
}
|
|
Validator::make($input, [
|
|
'name' => ['required', 'string', 'max:255'],
|
|
'email' => [
|
|
'required',
|
|
'string',
|
|
'email',
|
|
'max:255',
|
|
Rule::unique(User::class),
|
|
],
|
|
'password' => ['required', Password::defaults(), 'confirmed'],
|
|
])->validate();
|
|
|
|
if (User::count() == 0) {
|
|
// If this is the first user, make them the root user
|
|
// Team is already created in the database/seeders/ProductionSeeder.php
|
|
$user = (new User)->forceFill([
|
|
'id' => 0,
|
|
'name' => $input['name'],
|
|
'email' => $input['email'],
|
|
'password' => Hash::make($input['password']),
|
|
]);
|
|
$user->save();
|
|
$team = $user->teams()->first();
|
|
|
|
// Disable registration after first user is created
|
|
$settings = instanceSettings();
|
|
$settings->is_registration_enabled = false;
|
|
$settings->save();
|
|
} else {
|
|
$user = User::create([
|
|
'name' => $input['name'],
|
|
'email' => $input['email'],
|
|
'password' => Hash::make($input['password']),
|
|
]);
|
|
$team = $user->teams()->first();
|
|
if (isCloud()) {
|
|
$user->sendVerificationEmail();
|
|
} else {
|
|
$user->markEmailAsVerified();
|
|
}
|
|
}
|
|
// Set session variable
|
|
session(['currentTeam' => $user->currentTeam = $team]);
|
|
|
|
return $user;
|
|
}
|
|
}
|