The Wayback Machine - https://web.archive.org/web/20210719173831/https://github.com/laravel/laravel/pull/5546
Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[8.x] Don't trim current_password #5546

Merged
merged 1 commit into from Mar 1, 2021
Merged

[8.x] Don't trim current_password #5546

merged 1 commit into from Mar 1, 2021

Conversation

@rodrigopedra
Copy link
Contributor

@rodrigopedra rodrigopedra commented Mar 1, 2021

Inspired by laravel/framework#36415

As JetStream/Fortify uses a current_password field when allowing a user to change their password, and as JetStream is one of the starter kits listed on the docs, this PR adds current_password in the $except option of the TrimStrings middleware.

Inspired by laravel/framework#36415

As JetStream/Fortify uses a `current_password` field when allowing a user to change their password, and as JetStream is one of the starter kits listed on the docs, this PR adds `current_password` in the `$except` option of the `TrimStrings` middleware.
@gocanto
Copy link

@gocanto gocanto commented Mar 1, 2021

I would personally expect it to be trimmed if the given app/Http/Middleware/TrimStrings.php middleware is guarding those routes.

@rodrigopedra
Copy link
Contributor Author

@rodrigopedra rodrigopedra commented Mar 1, 2021

Hey @gocanto thanks for your reply.

As password was never trimmed on stock installation, a user could register themselves using a password starting or ending with one or more spaces.

Now if current_password gets trimmed, they would never be able to change their password because the current_password would mismatch their previously created password.

@GrahamCampbell GrahamCampbell changed the title Don't trim current_password [8.x] Don't trim current_password Mar 1, 2021
@taylorotwell taylorotwell merged commit 03be0af into laravel:8.x Mar 1, 2021
1 check passed
1 check passed
continuous-integration/styleci/pr The analysis has passed
Details
@rodrigopedra rodrigopedra deleted the rodrigopedra:patch-1 branch Mar 1, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
3 participants