[8.x] Require the correct password to rehash it when logging out other devices #36608
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
mboynes
changed the title
driesvints
requested changes
Mar 16, 2021
This was referenced Mar 17, 2021
kodiakhq bot
added a commit
to WesleyKlop/vote-system
that referenced
this pull request
Mar 17, 2021
Bumps [laravel/framework](https://github.com/laravel/framework) from 8.32.1 to 8.33.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/laravel/framework/releases">laravel/framework's releases</a>.</em></p> <blockquote> <h2>v8.33.0</h2> <h3>Added</h3> <ul> <li>Added broken pipe exception as lost connection error (<a href="https://github.com/laravel/framework/pull/36601">#36601</a>)</li> <li>Added missing option to resource (<a href="https://github.com/laravel/framework/pull/36562">#36562</a>)</li> <li>Introduce StringEncrypter interface (<a href="https://github.com/laravel/framework/pull/36578">#36578</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Fixed returns with Mail & Notification components (<a href="https://github.com/laravel/framework/pull/36559">#36559</a>)</li> <li>Stack driver fix: respect the defined processors in LogManager (<a href="https://github.com/laravel/framework/pull/36591">#36591</a>)</li> <li>Require the correct password to rehash it when logging out other devices (<a href="https://github.com/laravel/framework/pull/36608">#36608</a>, <a href="https://github.com/laravel/framework/commit/1e6161250074b8106c1fcf153eeaef7c0bf74c6c">1e61612</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Allow nullable columns for <code>AsArrayObject/AsCollection</code> casts (<a href="https://github.com/laravel/framework/pull/36526">#36526</a>)</li> <li>Accept callable class for reportable and renderable in exception handler (<a href="https://github.com/laravel/framework/pull/36551">#36551</a>)</li> <li>Container - detect circular dependencies (<a href="https://github.com/laravel/framework/commit/dd7274d23a9ee58cc1abdf7107403169a3994b68">dd7274d</a>, <a href="https://github.com/laravel/framework/commit/a712f72ca88f709335576530b31635738abd4c89">a712f72</a>, <a href="https://github.com/laravel/framework/commit/6f9bb4cdd84295cbcf7908cc4b4684f47f38b8cf">6f9bb4c</a>)</li> <li>Initialize CronExpression class using new keyword (<a href="https://github.com/laravel/framework/pull/36600">#36600</a>)</li> <li>Use different config key for overriding temporary url host in AwsTemporaryUrl method (<a href="https://github.com/laravel/framework/pull/36612">#36612</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/laravel/framework/blob/8.x/CHANGELOG-8.x.md">laravel/framework's changelog</a>.</em></p> <blockquote> <h1>Release Notes for 8.x</h1> <h2><a href="https://github.com/laravel/framework/compare/v8.33.0...8.x">Unreleased</a></h2> <h2><a href="https://github.com/laravel/framework/compare/v8.32.1...v8.33.0">v8.33.0 (2021-03-16)</a></h2> <h3>Added</h3> <ul> <li>Added broken pipe exception as lost connection error (<a href="https://github.com/laravel/framework/pull/36601">#36601</a>)</li> <li>Added missing option to resource (<a href="https://github.com/laravel/framework/pull/36562">#36562</a>)</li> <li>Introduce StringEncrypter interface (<a href="https://github.com/laravel/framework/pull/36578">#36578</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Fixed returns with Mail & Notification components (<a href="https://github.com/laravel/framework/pull/36559">#36559</a>)</li> <li>Stack driver fix: respect the defined processors in LogManager (<a href="https://github.com/laravel/framework/pull/36591">#36591</a>)</li> <li>Require the correct password to rehash it when logging out other devices (<a href="https://github.com/laravel/framework/pull/36608">#36608</a>, <a href="https://github.com/laravel/framework/commit/1e6161250074b8106c1fcf153eeaef7c0bf74c6c">1e61612</a>)</li> </ul> <h3>Changed</h3> <ul> <li>Allow nullable columns for <code>AsArrayObject/AsCollection</code> casts (<a href="https://github.com/laravel/framework/pull/36526">#36526</a>)</li> <li>Accept callable class for reportable and renderable in exception handler (<a href="https://github.com/laravel/framework/pull/36551">#36551</a>)</li> <li>Container - detect circular dependencies (<a href="https://github.com/laravel/framework/commit/dd7274d23a9ee58cc1abdf7107403169a3994b68">dd7274d</a>, <a href="https://github.com/laravel/framework/commit/a712f72ca88f709335576530b31635738abd4c89">a712f72</a>, <a href="https://github.com/laravel/framework/commit/6f9bb4cdd84295cbcf7908cc4b4684f47f38b8cf">6f9bb4c</a>)</li> <li>Initialize CronExpression class using new keyword (<a href="https://github.com/laravel/framework/pull/36600">#36600</a>)</li> <li>Use different config key for overriding temporary url host in AwsTemporaryUrl method (<a href="https://github.com/laravel/framework/pull/36612">#36612</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/laravel/framework/commit/354c57b8cb457549114074c500944455a288d6cc"><code>354c57b</code></a> patch</li> <li><a href="https://github.com/laravel/framework/commit/332844e5bde34f8db91aeca4d21cd4e0925d691e"><code>332844e</code></a> revert circular dep</li> <li><a href="https://github.com/laravel/framework/commit/9f986cef11b959679f530eb24d929b39a2690924"><code>9f986ce</code></a> [8.x] update changelog</li> <li><a href="https://github.com/laravel/framework/commit/acb117738ddb28ea7fc6a2029cf1d0d06c4b2b57"><code>acb1177</code></a> [8.x] Add DB::resetRecordsModifications (<a href="https://github.com/laravel/framework/issues/36617">#36617</a>)</li> <li><a href="https://github.com/laravel/framework/commit/03efea900247ed7b9fe0056311ad555033c6e854"><code>03efea9</code></a> fix conflicts</li> <li><a href="https://github.com/laravel/framework/commit/c25308a00c7bbd38401a6254ab403146da9cfd69"><code>c25308a</code></a> version</li> <li><a href="https://github.com/laravel/framework/commit/ebfa75fee5acef028a09f52a78a7069b1a09a723"><code>ebfa75f</code></a> Apply fixes from StyleCI (<a href="https://github.com/laravel/framework/issues/36615">#36615</a>)</li> <li><a href="https://github.com/laravel/framework/commit/eacabc70559e31e985408965f25f74542c56e8b6"><code>eacabc7</code></a> Merge branch 'hotfix/password-rehash' into 8.x</li> <li><a href="https://github.com/laravel/framework/commit/1e6161250074b8106c1fcf153eeaef7c0bf74c6c"><code>1e61612</code></a> formatting</li> <li><a href="https://github.com/laravel/framework/commit/d98cf8b5baca2d12341cdc1d75888cfe6fb67260"><code>d98cf8b</code></a> [8.x] Use different config key for overriding temporary url host in AwsTempor...</li> <li>Additional commits viewable in <a href="https://github.com/laravel/framework/compare/v8.32.1...v8.33.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>
This was referenced Mar 17, 2021
This was referenced Mar 17, 2021
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
SessionGuard::logoutOtherDevices()doesn't presently check the password it rehashes, and could therefore inadvertently change the user's password. In fact, the existing unit test demonstrates this possibility. This updatesSessionGuardto check the password prior to rehashing it to ensure that would never happen.Editor's note: I wasn't certain of which
Exceptionto throw and opted forAuthenticationException, but I would appreciate a second opinion on that choice. I also consideredValidationException,RuntimeException,AuthorizationException... all apply in their own way, none seem the obvious choice to me.