Malek TellissiandClaude Sonnet 4.6
4b99ffea15
Deploy / deploy (push) Successful in 16s
Matching users by email alone allows an attacker with a self-registered Nextcloud account to hijack any Filament user. Now we look up by nextcloud_id first; email is only used when creating a brand-new account, and nextcloud_id is immediately written to the row so future logins use the stable Nextcloud user ID. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
56 lines
1.2 KiB
PHP
56 lines
1.2 KiB
PHP
<?php
|
|
|
|
namespace App\Models;
|
|
|
|
use Filament\Models\Contracts\FilamentUser;
|
|
use Filament\Panel;
|
|
use Illuminate\Database\Eloquent\Factories\HasFactory;
|
|
use Illuminate\Foundation\Auth\User as Authenticatable;
|
|
use Illuminate\Notifications\Notifiable;
|
|
use Spatie\Permission\Traits\HasRoles;
|
|
|
|
class User extends Authenticatable implements FilamentUser
|
|
{
|
|
use HasFactory, Notifiable, HasRoles;
|
|
|
|
/**
|
|
* The attributes that are mass assignable.
|
|
*
|
|
* @var array<int, string>
|
|
*/
|
|
protected $fillable = [
|
|
'name',
|
|
'email',
|
|
'password',
|
|
'nextcloud_id',
|
|
];
|
|
|
|
/**
|
|
* The attributes that should be hidden for serialization.
|
|
*
|
|
* @var array<int, string>
|
|
*/
|
|
protected $hidden = [
|
|
'password',
|
|
'remember_token',
|
|
];
|
|
|
|
/**
|
|
* Get the attributes that should be cast.
|
|
*
|
|
* @return array<string, string>
|
|
*/
|
|
protected function casts(): array
|
|
{
|
|
return [
|
|
'email_verified_at' => 'datetime',
|
|
'password' => 'hashed',
|
|
];
|
|
}
|
|
|
|
public function canAccessPanel(Panel $panel): bool
|
|
{
|
|
return $this->hasAnyRole(['sms-admin', 'sms-manager', 'sms-viewer']);
|
|
}
|
|
}
|