diff --git a/UPGRADE.md b/UPGRADE.md index 7e241cfb..f6d2e14b 100644 --- a/UPGRADE.md +++ b/UPGRADE.md @@ -2,6 +2,36 @@ Future upgrade notes will be placed here. +--- + +## Upgrading to 2.x from 1.x + +### Confirm Password Feature Disabled by Default + +> **If you're using two-factor authentication with `confirmPassword`, no changes are needed; otherwise, enable password confirmation manually.** + +If your application is already using two-factor authentication with `confirmPassword` enabled, no changes are required — everything should continue to work as before: + +```php +'features' => [ + // ... + Features::twoFactorAuthentication([ + 'confirmPassword' => true, + ]), + // ... +], +``` + +If your application is **not** using two-factor authentication but **is** using `password.confirm` routes, you will need to enable the password confirmation feature in your `fortify.php` configuration file by adding the following line to the `features` array: + +```php +'features' => [ + // ... + Features::passwordConfirmation(), + // ... +], +``` + ## Upgrading To 1.7.3 From 1.x ### Two Factor Brute Force Attack Security Fix diff --git a/config/fortify.php b/config/fortify.php index 289cb2b4..e9d53433 100644 --- a/config/fortify.php +++ b/config/fortify.php @@ -64,6 +64,7 @@ Features::emailVerification(), Features::updateProfileInformation(), Features::updatePasswords(), + Features::passwordConfirmation(), Features::twoFactorAuthentication(), ], ]; diff --git a/routes/routes.php b/routes/routes.php index a8f22e01..d0b32387 100644 --- a/routes/routes.php +++ b/routes/routes.php @@ -111,19 +111,21 @@ } // Password Confirmation... - if ($enableViews) { - Route::get(RoutePath::for('password.confirm', '/user/confirm-password'), [ConfirmablePasswordController::class, 'show']) - ->middleware([config('fortify.auth_middleware', 'auth').':'.config('fortify.guard')]) - ->name('password.confirm'); - } + if (Features::enabled(Features::passwordConfirmation()) || Features::optionEnabled(Features::twoFactorAuthentication(), 'confirmPassword')) { + if ($enableViews) { + Route::get(RoutePath::for('password.confirm', '/user/confirm-password'), [ConfirmablePasswordController::class, 'show']) + ->middleware([config('fortify.auth_middleware', 'auth').':'.config('fortify.guard')]) + ->name('password.confirm'); + } - Route::get(RoutePath::for('password.confirmation', '/user/confirmed-password-status'), [ConfirmedPasswordStatusController::class, 'show']) - ->middleware([config('fortify.auth_middleware', 'auth').':'.config('fortify.guard')]) - ->name('password.confirmation'); + Route::get(RoutePath::for('password.confirmation', '/user/confirmed-password-status'), [ConfirmedPasswordStatusController::class, 'show']) + ->middleware([config('fortify.auth_middleware', 'auth').':'.config('fortify.guard')]) + ->name('password.confirmation'); - Route::post(RoutePath::for('password.confirm', '/user/confirm-password'), [ConfirmablePasswordController::class, 'store']) - ->middleware([config('fortify.auth_middleware', 'auth').':'.config('fortify.guard')]) - ->name('password.confirm.store'); + Route::post(RoutePath::for('password.confirm', '/user/confirm-password'), [ConfirmablePasswordController::class, 'store']) + ->middleware([config('fortify.auth_middleware', 'auth').':'.config('fortify.guard')]) + ->name('password.confirm.store'); + } // Two Factor Authentication... if (Features::enabled(Features::twoFactorAuthentication())) { diff --git a/src/Features.php b/src/Features.php index 38ff61a5..cc63a390 100644 --- a/src/Features.php +++ b/src/Features.php @@ -91,6 +91,16 @@ public static function resetPasswords() return 'reset-passwords'; } + /** + * Enable the password confirmation feature. + * + * @return string + */ + public static function passwordConfirmation() + { + return 'password-confirmation'; + } + /** * Enable the email verification feature. * diff --git a/stubs/fortify.php b/stubs/fortify.php index cfe82722..d304abab 100644 --- a/stubs/fortify.php +++ b/stubs/fortify.php @@ -149,6 +149,7 @@ // Features::emailVerification(), Features::updateProfileInformation(), Features::updatePasswords(), + Features::passwordConfirmation(), Features::twoFactorAuthentication([ 'confirm' => true, 'confirmPassword' => true,