X-Git-Url: http://source.bookstackapp.com/bookstack/blobdiff_plain/14feef3679b6ecdce656d56dd754357997084632..refs/pull/166/head:/app/Http/Controllers/Auth/AuthController.php

diff --git a/app/Http/Controllers/Auth/AuthController.php b/app/Http/Controllers/Auth/AuthController.php
index 21abfb24c..2cbc047ce 100644
--- a/app/Http/Controllers/Auth/AuthController.php
+++ b/app/Http/Controllers/Auth/AuthController.php
@@ -1,7 +1,6 @@
-<?php
-
-namespace BookStack\Http\Controllers\Auth;
+<?php namespace BookStack\Http\Controllers\Auth;
 
+use BookStack\Exceptions\AuthException;
 use Illuminate\Contracts\Auth\Authenticatable;
 use Illuminate\Http\Request;
 use BookStack\Exceptions\SocialSignInException;
@@ -34,16 +33,15 @@ class AuthController extends Controller
     protected $redirectAfterLogout = '/login';
     protected $username = 'email';
 
-
     protected $socialAuthService;
     protected $emailConfirmationService;
     protected $userRepo;
 
     /**
      * Create a new authentication controller instance.
-     * @param SocialAuthService        $socialAuthService
+     * @param SocialAuthService $socialAuthService
      * @param EmailConfirmationService $emailConfirmationService
-     * @param UserRepo                 $userRepo
+     * @param UserRepo $userRepo
      */
     public function __construct(SocialAuthService $socialAuthService, EmailConfirmationService $emailConfirmationService, UserRepo $userRepo)
     {
@@ -51,6 +49,8 @@ class AuthController extends Controller
         $this->socialAuthService = $socialAuthService;
         $this->emailConfirmationService = $emailConfirmationService;
         $this->userRepo = $userRepo;
+        $this->redirectPath = baseUrl('/');
+        $this->redirectAfterLogout = baseUrl('/login');
         $this->username = config('auth.method') === 'standard' ? 'email' : 'username';
         parent::__construct();
     }
@@ -63,15 +63,15 @@ class AuthController extends Controller
     protected function validator(array $data)
     {
         return Validator::make($data, [
-            'name'     => 'required|max:255',
-            'email'    => 'required|email|max:255|unique:users',
+            'name' => 'required|max:255',
+            'email' => 'required|email|max:255|unique:users',
             'password' => 'required|min:6',
         ]);
     }
 
     protected function checkRegistrationAllowed()
     {
-        if (!\Setting::get('registration-enabled')) {
+        if (!setting('registration-enabled')) {
             throw new UserRegistrationException('Registrations are currently disabled.', '/login');
         }
     }
@@ -112,23 +112,34 @@ class AuthController extends Controller
     /**
      * Overrides the action when a user is authenticated.
      * If the user authenticated but does not exist in the user table we create them.
-     * @param Request         $request
+     * @param Request $request
      * @param Authenticatable $user
      * @return \Illuminate\Http\RedirectResponse
+     * @throws AuthException
      */
     protected function authenticated(Request $request, Authenticatable $user)
     {
-        if(!$user->exists && $user->email === null && !$request->has('email')) {
+        // Explicitly log them out for now if they do no exist.
+        if (!$user->exists) auth()->logout($user);
+
+        if (!$user->exists && $user->email === null && !$request->has('email')) {
             $request->flash();
             session()->flash('request-email', true);
             return redirect('/login');
         }
 
-        if(!$user->exists && $user->email === null && $request->has('email')) {
+        if (!$user->exists && $user->email === null && $request->has('email')) {
             $user->email = $request->get('email');
         }
 
-        if(!$user->exists) {
+        if (!$user->exists) {
+
+            // Check for users with same email already
+            $alreadyUser = $user->newQuery()->where('email', '=', $user->email)->count() > 0;
+            if ($alreadyUser) {
+                throw new AuthException('A user with the email ' . $user->email . ' already exists but with different credentials.');
+            }
+
             $user->save();
             $this->userRepo->attachDefaultRole($user);
             auth()->login($user);
@@ -150,8 +161,8 @@ class AuthController extends Controller
 
         // Create an array of the user data to create a new user instance
         $userData = [
-            'name'     => $socialUser->getName(),
-            'email'    => $socialUser->getEmail(),
+            'name' => $socialUser->getName(),
+            'email' => $socialUser->getEmail(),
             'password' => str_random(30)
         ];
         return $this->registerUser($userData, $socialAccount);
@@ -159,7 +170,7 @@ class AuthController extends Controller
 
     /**
      * The registrations flow for all users.
-     * @param array                    $userData
+     * @param array $userData
      * @param bool|false|SocialAccount $socialAccount
      * @return \Illuminate\Http\RedirectResponse|\Illuminate\Routing\Redirector
      * @throws UserRegistrationException
@@ -167,8 +178,8 @@ class AuthController extends Controller
      */
     protected function registerUser(array $userData, $socialAccount = false)
     {
-        if (\Setting::get('registration-restrict')) {
-            $restrictedEmailDomains = explode(',', str_replace(' ', '', \Setting::get('registration-restrict')));
+        if (setting('registration-restrict')) {
+            $restrictedEmailDomains = explode(',', str_replace(' ', '', setting('registration-restrict')));
             $userEmailDomain = $domain = substr(strrchr($userData['email'], "@"), 1);
             if (!in_array($userEmailDomain, $restrictedEmailDomains)) {
                 throw new UserRegistrationException('That email domain does not have access to this application', '/register');
@@ -180,14 +191,12 @@ class AuthController extends Controller
             $newUser->socialAccounts()->save($socialAccount);
         }
 
-        if (\Setting::get('registration-confirmation') || \Setting::get('registration-restrict')) {
-            $newUser->email_confirmed = false;
+        if (setting('registration-confirmation') || setting('registration-restrict')) {
             $newUser->save();
             $this->emailConfirmationService->sendConfirmation($newUser);
             return redirect('/register/confirm');
         }
 
-        $newUser->email_confirmed = true;
         auth()->login($newUser);
         session()->flash('success', 'Thanks for signing up! You are now registered and signed in.');
         return redirect($this->redirectPath());