Malek TellissiandClaude Sonnet 4.6
4b99ffea15
Deploy / deploy (push) Successful in 16s
Matching users by email alone allows an attacker with a self-registered Nextcloud account to hijack any Filament user. Now we look up by nextcloud_id first; email is only used when creating a brand-new account, and nextcloud_id is immediately written to the row so future logins use the stable Nextcloud user ID. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
55 lines
1.5 KiB
PHP
55 lines
1.5 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Controllers;
|
|
|
|
use App\Models\User;
|
|
use Illuminate\Http\RedirectResponse;
|
|
use Illuminate\Support\Facades\Auth;
|
|
use Illuminate\Support\Str;
|
|
use Laravel\Socialite\Facades\Socialite;
|
|
|
|
class OAuthController extends Controller
|
|
{
|
|
public function redirect(): RedirectResponse
|
|
{
|
|
return Socialite::driver('nextcloud')->redirect();
|
|
}
|
|
|
|
public function callback(): RedirectResponse
|
|
{
|
|
$socialUser = Socialite::driver('nextcloud')->user();
|
|
|
|
$ncGroups = $socialUser->getRaw()['ocs']['data']['groups'] ?? [];
|
|
$smsRoles = array_intersect($ncGroups, ['sms-admin', 'sms-manager', 'sms-viewer']);
|
|
|
|
if (empty($smsRoles)) {
|
|
abort(403, 'Kein Zugriff — bitte einer SMS-Gruppe in Nextcloud beitreten.');
|
|
}
|
|
|
|
$nextcloudId = (string) $socialUser->getId();
|
|
|
|
$user = User::where('nextcloud_id', $nextcloudId)->first();
|
|
|
|
if (! $user) {
|
|
$user = User::where('email', $socialUser->getEmail())->first();
|
|
|
|
if (! $user) {
|
|
$user = new User([
|
|
'name' => $socialUser->getName() ?? $socialUser->getNickname() ?? $socialUser->getEmail(),
|
|
'email' => $socialUser->getEmail(),
|
|
'password' => Str::random(40),
|
|
]);
|
|
}
|
|
|
|
$user->nextcloud_id = $nextcloudId;
|
|
$user->save();
|
|
}
|
|
|
|
$user->syncRoles(array_values($smsRoles));
|
|
|
|
Auth::login($user, remember: true);
|
|
|
|
return redirect('/dashboard');
|
|
}
|
|
}
|