X-Git-Url: http://source.bookstackapp.com/bookstack/blobdiff_plain/575b85021d4f6d9507816710a5b96f6a9742d6bf..refs/pull/2393/head:/app/Http/Controllers/Auth/LoginController.php diff --git a/app/Http/Controllers/Auth/LoginController.php b/app/Http/Controllers/Auth/LoginController.php index 1ff86fff6..1252e6217 100644 --- a/app/Http/Controllers/Auth/LoginController.php +++ b/app/Http/Controllers/Auth/LoginController.php @@ -2,6 +2,8 @@ namespace BookStack\Http\Controllers\Auth; +use Activity; +use BookStack\Actions\ActivityType; use BookStack\Auth\Access\SocialAuthService; use BookStack\Exceptions\LoginAttemptEmailNeededException; use BookStack\Exceptions\LoginAttemptException; @@ -38,11 +40,12 @@ class LoginController extends Controller */ public function __construct(SocialAuthService $socialAuthService) { - $this->middleware('guest', ['only' => ['getLogin', 'postLogin']]); + $this->middleware('guest', ['only' => ['getLogin', 'login']]); + $this->middleware('guard:standard,ldap', ['only' => ['login', 'logout']]); + $this->socialAuthService = $socialAuthService; $this->redirectPath = url('/'); $this->redirectAfterLogout = url('/http/source.bookstackapp.com/login'); - parent::__construct(); } public function username() @@ -65,7 +68,6 @@ class LoginController extends Controller { $socialDrivers = $this->socialAuthService->getActiveDrivers(); $authMethod = config('auth.method'); - $samlEnabled = config('saml2.enabled') === true; if ($request->has('email')) { session()->flashInput([ @@ -74,10 +76,18 @@ class LoginController extends Controller ]); } + // Store the previous location for redirect after login + $previous = url()->previous(''); + if ($previous && $previous !== url('/http/source.bookstackapp.com/login') && setting('app-public')) { + $isPreviousFromInstance = (strpos($previous, url('/')) === 0); + if ($isPreviousFromInstance) { + redirect()->setIntendedUrl($previous); + } + } + return view('auth.login', [ 'socialDrivers' => $socialDrivers, 'authMethod' => $authMethod, - 'samlEnabled' => $samlEnabled, ]); } @@ -92,6 +102,7 @@ class LoginController extends Controller public function login(Request $request) { $this->validateLogin($request); + $username = $request->get($this->username()); // If the class is using the ThrottlesLogins trait, we can automatically throttle // the login attempts for this application. We'll key this by the username and @@ -100,6 +111,7 @@ class LoginController extends Controller $this->hasTooManyLoginAttempts($request)) { $this->fireLockoutEvent($request); + Activity::logFailedLogin($username); return $this->sendLockoutResponse($request); } @@ -108,6 +120,7 @@ class LoginController extends Controller return $this->sendLoginResponse($request); } } catch (LoginAttemptException $exception) { + Activity::logFailedLogin($username); return $this->sendLoginAttemptExceptionResponse($exception, $request); } @@ -116,9 +129,56 @@ class LoginController extends Controller // user surpasses their maximum number of attempts they will get locked out. $this->incrementLoginAttempts($request); + Activity::logFailedLogin($username); return $this->sendFailedLoginResponse($request); } + /** + * The user has been authenticated. + * + * @param \Illuminate\Http\Request $request + * @param mixed $user + * @return mixed + */ + protected function authenticated(Request $request, $user) + { + // Authenticate on all session guards if a likely admin + if ($user->can('users-manage') && $user->can('user-roles-manage')) { + $guards = ['standard', 'ldap', 'saml2']; + foreach ($guards as $guard) { + auth($guard)->login($user); + } + } + + $this->logActivity(ActivityType::AUTH_LOGIN, $user); + return redirect()->intended($this->redirectPath()); + } + + /** + * Validate the user login request. + * + * @param \Illuminate\Http\Request $request + * @return void + * + * @throws \Illuminate\Validation\ValidationException + */ + protected function validateLogin(Request $request) + { + $rules = ['password' => 'required|string']; + $authMethod = config('auth.method'); + + if ($authMethod === 'standard') { + $rules['email'] = 'required|email'; + } + + if ($authMethod === 'ldap') { + $rules['username'] = 'required|string'; + $rules['email'] = 'email'; + } + + $request->validate($rules); + } + /** * Send a response when a login attempt exception occurs. */ @@ -136,18 +196,4 @@ class LoginController extends Controller return redirect('/login'); } - /** - * Log the user out of the application. - */ - public function logout(Request $request) - { - if (config('saml2.enabled') && session()->get('last_login_type') === 'saml2') { - return redirect('/saml2/logout'); - } - - $this->guard()->logout(); - $request->session()->invalidate(); - - return $this->loggedOut($request) ?: redirect('/'); - } }