Verified Commit 0c253882 authored by Korko's avatar Korko
Browse files

Ensure key is valid when given

parent 1321111e
......@@ -4,6 +4,7 @@ namespace App\Http\Middleware;
use Closure;
use Crypt;
use Illuminate\Contracts\Encryption\DecryptException;
class HandleEncryptionKey
{
......@@ -14,13 +15,20 @@ class HandleEncryptionKey
* @param \Closure $next
* @return mixed
*/
public function handle($request, Closure $next)
public function handle($request, Closure $next, $parameterToCheck, $fieldToCheck)
{
$key = base64_decode($request->input('key'));
if ($key) {
Crypt::setKey($key);
}
try {
// Accessing the attribute is enough
$request->route()->parameters()[$parameterToCheck]->$fieldToCheck;
} catch (DecryptException $e) {
abort(500, "Invalid encryption key");
}
return $next($request);
}
}
......@@ -132,7 +132,8 @@ vue__WEBPACK_IMPORTED_MODULE_17___default.a.use(vuelidate__WEBPACK_IMPORTED_MODU
url: "/dearsanta/".concat(this.data.participant.hash, "/fetchState"),
type: 'POST',
data: {
_token: this.csrf
_token: this.csrf,
key: this.key
},
success: function success(data) {
if (data.emails) {
......
......@@ -356,7 +356,8 @@ function _defineProperty(obj, key, value) { if (key in obj) { Object.definePrope
url: "/org/".concat(this.data.draw, "/fetchState"),
type: 'POST',
data: {
_token: this.csrf
_token: this.csrf,
key: this.key
},
success: function success(data) {
if (data.participants) {
......
......@@ -58,7 +58,7 @@
return jQuery.ajax({
url: `/dearsanta/${this.data.participant.hash}/fetchState`,
type: 'POST',
data: { _token: this.csrf },
data: { _token: this.csrf, key: this.key },
success(data) {
if (data.emails) {
Object.values(data.emails).forEach(email => {
......
......@@ -51,7 +51,7 @@
return jQuery.ajax({
url: `/org/${this.data.draw}/fetchState`,
type: 'POST',
data: { _token: this.csrf },
data: { _token: this.csrf, key: this.key },
success(data) {
if (data.participants) {
Object.values(data.participants).forEach(participant => {
......
......@@ -21,7 +21,7 @@ Route::get('/faq', 'RandomFormController@faq')->name('faq');
Route::pattern('participant', '[0-9a-zA-Z]{'.config('hashids.connections.santa.length').'}');
Route::get('/dearsanta/{participant}', 'DearSantaController@view')->name('dearsanta');
Route::middleware(['decrypt.key'])->group(function () {
Route::middleware(['decrypt.key:participant,name'])->group(function () {
Route::post('/dearsanta/{participant}', 'DearSantaController@fetch')->name('dearsanta.fetch');
Route::post('/dearsanta/{participant}/send', 'DearSantaController@handle')->name('dearsanta.contact');
Route::post('/dearsanta/{participant}/fetchState', 'DearSantaController@fetchState')->name('dearsanta.fetchState');
......@@ -30,7 +30,7 @@ Route::middleware(['decrypt.key'])->group(function () {
Route::pattern('draw', '[0-9a-zA-Z]{'.config('hashids.connections.draw.length').'}');
Route::get('/org/{draw}', 'OrganizerController@view')->name('organizerPanel');
Route::middleware(['decrypt.key'])->group(function () {
Route::middleware(['decrypt.key:draw,mail_title'])->group(function () {
Route::post('/org/{draw}', 'OrganizerController@fetch')->name('organizerPanel.fetch');
Route::delete('/org/{draw}', 'OrganizerController@delete')->name('organizerPanel.delete');
Route::post('/org/{draw}/fetchState', 'OrganizerController@fetchState')->name('organizerPanel.fetchState');
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment