Send request to "reset-password" route without password will cause "Undefined index" error

[kurorido]

• Fortify Version: 1.7.8
• Laravel Version: 8.34.0
• PHP Version: 7.4.15
• Database Driver & Version: MySQL 8.0

Description:

The payload sent to "reset-password" route

{
    "token": "f46be4baf70e56946d8b17e066afeab45f028afe8dd734b39b2d7442043b5a2f",
    "email": "test@test.com",
}

will cause the error in laravel/framework

{
    "message": "Undefined index: password",
    "exception": "ErrorException",
    "file": "/vendor/laravel/framework/src/Illuminate/Auth/Passwords/PasswordBroker.php",
    "line": 95,
    "trace": [
        {
            "file": "/vendor/laravel/framework/src/Illuminate/Auth/Passwords/PasswordBroker.php",
            "line": 95,
            "function": "handleError",
            "class": "Illuminate\\Foundation\\Bootstrap\\HandleExceptions",
            "type": "->"
        },
   .....

Steps To Reproduce:

Sent the payload above.

Suggest Solution:

Solution 1:

Modify the Fortify Package in NewPasswordController.php to validate password before pass to laravel/framework

Solution 2:

Modify the laravel/framework in PasswordBroker.php to prevent undefined index

change the line $password = $credentials['password']; to $password = $credentials['password'] ?? null;

[driesvints]

Thanks. A fix has been merged and will be tagged tomorrow.