I am working on a Laravel project. I was not the original developer, so if I make a mistake, forgive me and explain what it was please.
In this project, we have a module to request a new password. when the form is submited, the user is redirected to route('password.request')
which is, I believe, somewhere hidden in the framework.
The problem is that when the user gets it's new password, he is automaticaly logged in and can access the pages. But he is not supposed to because he does not have admin rights.
So I tried to logout and redirect the user to the main page, without any luck.
Can someone explain why is laravel (or "me", as they are some parts of the project I have not explored yet) doing that and how to fix this?
reset.blade.php (form to request new password)
form class="form-horizontal" role="form" method="POST" action="{{ route('password.request') }}">
{{ csrf_field() }}
<input type="hidden" name="token" value="{{ $token }}">
....
my custom logout route:
Route::get('/customLogout', 'Auth\LoginController@customLogout');
resetPasswordController.php
<?php
namespace App\Http\Controllers\Auth;
use App\Http\Controllers\Controller;
use Illuminate\Foundation\Auth\ResetsPasswords;
class ResetPasswordController extends Controller
{
/*
|--------------------------------------------------------------------------
| Password Reset Controller
|--------------------------------------------------------------------------
|
| This controller is responsible for handling password reset requests
| and uses a simple trait to include this behavior. You're free to
| explore this trait and override any methods you wish to tweak.
|
*/
use ResetsPasswords;
/**
* Where to redirect users after resetting their password.
*
* @var string
*/
protected $redirectTo = '/customLogout';
/**
* Create a new controller instance.
*
* @return void
*/
public function __construct()
{
$this->middleware('guest');
}
}
method in LoginController.php
public function customLogout(){
//Session::flush();
return redirect()->route('/');
}
php artisan route:list
?