lonnieezell / myth-auth

One-stop Auth package for CodeIgniter 4
MIT License
637 stars 208 forks source link

AuthController should use $reservedRoutes config variables in named route redirects #560

Closed manageruz closed 2 years ago

manageruz commented 2 years ago

Now Myth:Auth uses $reservedRoutes config variable to generate content of Myth's routes.php file and users can customize it. In AuthController.php file we can find many redirects to the named routes, like return redirect()->to(route_to('reset-password') inside attemptLogin() method return redirect()->route('login')->with('message', lang('Auth.activationSuccess')); inside attemptRegister() method return redirect()->route('login')->with('error', lang('Auth.forgotDisabled')); inside forgotPassword() method return redirect()->route('reset-password')->with('message', lang('Auth.forgotEmailSent')); inside attemptForgot() method return redirect()->route('login')->with('error', lang('Auth.forgotDisabled')); inside resetPassword() method and so on.

So all this will work well until user customize $reservedRoutes config variable. For example if user changes default

public $reservedRoutes = [
    'login'                   => 'login',
    // ...
    'reset-password'          => 'reset-password',
];

to

public $reservedRoutes = [
    'login'                   => 'myth-login',
    // ...
    'reset-password'          => 'change-password',
 ];

then the above listed named route redirects with redirect()->route('login') and redirect()->route('reset-password') will fail. I think all use cases should be replaced with $reservedRoutes config values. Or am i missing something?

MGatner commented 2 years ago

I believe you are correct. The configurable routes was a recent addition and not the most thoroughly checked.

mjamilasfihani commented 2 years ago

Worked on it! Thank you @manageruz