From 1617734907c38dd5db60f8526bc3d8a341ee4e62 Mon Sep 17 00:00:00 2001 From: Your Name Date: Thu, 27 Aug 2026 13:12:52 +0930 Subject: [PATCH] Revert "Merge pull request #6851 from pixelfed/fix/phpstan-auth-request-scope-2" This reverts commit ce4baf69958cc36d6b6ee3f710849b6e06223661, reversing changes made to 9235cb979affb6e9fd7ddbb74ace945da1ea2589. --- app/Http/Controllers/AccountController.php | 12 +++++------ .../Controllers/Api/BaseApiController.php | 2 +- app/Http/Controllers/AvatarController.php | 5 +++-- app/Http/Controllers/CircleController.php | 5 +++-- app/Http/Controllers/CollectionController.php | 9 ++++---- app/Http/Controllers/CommentController.php | 5 +++-- app/Http/Controllers/ComposeController.php | 2 +- app/Http/Controllers/ContactController.php | 5 +++-- app/Http/Controllers/DiscoverController.php | 7 ++++--- .../Controllers/HashtagFollowController.php | 2 +- app/Http/Controllers/Import/Instagram.php | 17 ++++++++------- .../Controllers/InternalApiController.php | 21 ++++++++++--------- app/Http/Controllers/MicroController.php | 3 ++- app/Http/Controllers/NewsroomController.php | 7 ++++--- app/Http/Controllers/ProfileController.php | 20 +++++++++--------- app/Http/Controllers/PublicApiController.php | 13 ++++++------ app/Http/Controllers/ReportController.php | 2 +- .../Controllers/Settings/ExportSettings.php | 20 +++++++++--------- .../Controllers/Settings/HomeSettings.php | 8 +++---- .../Controllers/Settings/PrivacySettings.php | 21 ++++++++++--------- .../Settings/RelationshipSettings.php | 3 ++- .../Controllers/Settings/SecuritySettings.php | 17 ++++++++------- app/Http/Controllers/SettingsController.php | 20 +++++++++--------- app/Http/Controllers/SiteController.php | 3 ++- app/Http/Controllers/StatusController.php | 21 ++++++++++--------- app/Http/Controllers/TimelineController.php | 3 ++- app/Http/Controllers/UserInviteController.php | 8 +++---- app/Http/Middleware/AccountInterstitial.php | 3 ++- app/Http/Middleware/Admin.php | 3 ++- app/Http/Middleware/Api/Admin.php | 3 ++- app/Http/Middleware/DangerZone.php | 2 +- 31 files changed, 146 insertions(+), 126 deletions(-) diff --git a/app/Http/Controllers/AccountController.php b/app/Http/Controllers/AccountController.php index 68a58a0a2..f4ed34bcd 100644 --- a/app/Http/Controllers/AccountController.php +++ b/app/Http/Controllers/AccountController.php @@ -62,7 +62,7 @@ class AccountController extends Controller $allowed = ['like', 'follow']; $timeago = Carbon::now()->subMonths(3); - $profile = $request->user()->profile; + $profile = Auth::user()->profile; $following = $profile->following->pluck('id'); $notifications = Notification::whereIn('actor_id', $following) @@ -387,7 +387,7 @@ class AccountController extends Controller public function followRequests(Request $request) { - $pid = $request->user()->profile->id; + $pid = Auth::user()->profile->id; $followers = FollowRequest::whereFollowingId($pid)->orderBy('id', 'desc')->whereIsRejected(0)->simplePaginate(10); return view('account.follow-requests', compact('followers')); @@ -395,7 +395,7 @@ class AccountController extends Controller public function followRequestsJson(Request $request) { - $pid = $request->user()->profile_id; + $pid = Auth::user()->profile_id; $followers = FollowRequest::whereFollowingId($pid)->orderBy('id', 'desc')->whereIsRejected(0)->get(); $res = [ 'count' => $followers->count(), @@ -424,7 +424,7 @@ class AccountController extends Controller 'id' => 'required|integer|min:1', ]); - $pid = $request->user()->profile->id; + $pid = Auth::user()->profile->id; $action = $request->input('action') === 'accept' ? 'accept' : 'reject'; $id = $request->input('id'); $followRequest = FollowRequest::whereFollowingId($pid)->findOrFail($id); @@ -492,7 +492,7 @@ class AccountController extends Controller 'trustDevice' => 'nullable', ]); - $user = $request->user(); + $user = Auth::user(); $password = $request->input('password'); $trustDevice = $request->input('trustDevice') == 'on'; $next = $request->session()->get('redirectNext', '/'); @@ -531,7 +531,7 @@ class AccountController extends Controller $this->validate($request, [ 'code' => 'required|string|max:32', ]); - $user = $request->user(); + $user = Auth::user(); $code = $request->input('code'); $google2fa = new Google2FA; $verify = $google2fa->verifyKey($user->{'2fa_secret'}, $code); diff --git a/app/Http/Controllers/Api/BaseApiController.php b/app/Http/Controllers/Api/BaseApiController.php index 126655d23..512ccbbf2 100644 --- a/app/Http/Controllers/Api/BaseApiController.php +++ b/app/Http/Controllers/Api/BaseApiController.php @@ -88,7 +88,7 @@ class BaseApiController extends Controller ]); try { - $user = $request->user(); + $user = Auth::user(); $profile = $user->profile; $file = $request->file('upload'); $path = (new AvatarController)->getPath($user, $file); diff --git a/app/Http/Controllers/AvatarController.php b/app/Http/Controllers/AvatarController.php index 0b1f57ca1..66335bb44 100644 --- a/app/Http/Controllers/AvatarController.php +++ b/app/Http/Controllers/AvatarController.php @@ -5,6 +5,7 @@ namespace App\Http\Controllers; use App\Avatar; use App\Jobs\AvatarPipeline\AvatarOptimize; use Illuminate\Http\Request; +use Illuminate\Support\Facades\Auth; use Illuminate\Support\Facades\Cache; use Illuminate\Support\Str; @@ -22,7 +23,7 @@ class AvatarController extends Controller ]); try { - $user = $request->user(); + $user = Auth::user(); $profile = $user->profile; $file = $request->file('avatar'); $path = $this->getPath($user, $file); @@ -113,7 +114,7 @@ class AvatarController extends Controller public function deleteAvatar(Request $request) { - $user = $request->user(); + $user = Auth::user(); $profile = $user->profile; $avatar = $profile->avatar; diff --git a/app/Http/Controllers/CircleController.php b/app/Http/Controllers/CircleController.php index c79de33b3..8e20ac17f 100644 --- a/app/Http/Controllers/CircleController.php +++ b/app/Http/Controllers/CircleController.php @@ -4,6 +4,7 @@ namespace App\Http\Controllers; use App\Circle; use Illuminate\Http\Request; +use Illuminate\Support\Facades\Auth; use Illuminate\Validation\Rule; class CircleController extends Controller @@ -15,7 +16,7 @@ class CircleController extends Controller public function home(Request $request) { - $circles = Circle::whereProfileId($request->user()->profile->id) + $circles = Circle::whereProfileId(Auth::user()->profile->id) ->orderByDesc('created_at') ->paginate(10); @@ -45,7 +46,7 @@ class CircleController extends Controller ]); $circle = Circle::firstOrCreate([ - 'profile_id' => $request->user()->profile->id, + 'profile_id' => Auth::user()->profile->id, 'name' => $request->input('name'), ], [ 'description' => $request->input('description'), diff --git a/app/Http/Controllers/CollectionController.php b/app/Http/Controllers/CollectionController.php index 137e300ac..240e0880f 100644 --- a/app/Http/Controllers/CollectionController.php +++ b/app/Http/Controllers/CollectionController.php @@ -10,13 +10,14 @@ use App\Services\FollowerService; use App\Services\StatusService; use App\Status; use Illuminate\Http\Request; +use Illuminate\Support\Facades\Auth; class CollectionController extends Controller { public function create(Request $request) { - abort_if(! $request->user(), 403); - $profile = $request->user()->profile; + abort_if(! Auth::check(), 403); + $profile = Auth::user()->profile; $collection = Collection::firstOrCreate([ 'profile_id' => $profile->id, @@ -48,7 +49,7 @@ class CollectionController extends Controller public function index(Request $request) { - abort_if(! $request->user(), 403); + abort_if(! Auth::check(), 403); return $request->all(); } @@ -82,7 +83,7 @@ class CollectionController extends Controller 'description' => 'nullable|max:500', 'visibility' => 'required|alpha|in:public,private,draft', ]); - $profile = $request->user()->profile; + $profile = Auth::user()->profile; $collection = Collection::whereProfileId($profile->id)->findOrFail($id); if ($collection->items()->count() == 0) { abort(404); diff --git a/app/Http/Controllers/CommentController.php b/app/Http/Controllers/CommentController.php index 2e1e50171..565a9fde9 100644 --- a/app/Http/Controllers/CommentController.php +++ b/app/Http/Controllers/CommentController.php @@ -11,6 +11,7 @@ use App\Status; use App\Transformer\Api\StatusTransformer; use App\UserFilter; use Illuminate\Http\Request; +use Illuminate\Support\Facades\Auth; use Illuminate\Support\Facades\DB; use League\Fractal; use League\Fractal\Serializer\ArraySerializer; @@ -25,7 +26,7 @@ class CommentController extends Controller public function store(Request $request) { - if (! $request->user()) { + if (Auth::check() === false) { abort(403); } $this->validate($request, [ @@ -37,7 +38,7 @@ class CommentController extends Controller $statusId = $request->input('item'); $nsfw = $request->input('sensitive', false); - $user = $request->user(); + $user = Auth::user(); $profile = $user->profile; $status = Status::findOrFail($statusId); diff --git a/app/Http/Controllers/ComposeController.php b/app/Http/Controllers/ComposeController.php index 2661b8876..43dd00b08 100644 --- a/app/Http/Controllers/ComposeController.php +++ b/app/Http/Controllers/ComposeController.php @@ -172,7 +172,7 @@ class ComposeController extends Controller ], ]); - $user = $request->user(); + $user = Auth::user(); abort_if($user->has_roles && ! UserRoleService::can('can-post', $user->id), 403, 'Invalid permissions for this action'); $limitKey = 'compose:rate-limit:media-updates:'.$user->id; diff --git a/app/Http/Controllers/ContactController.php b/app/Http/Controllers/ContactController.php index 347de80b5..948efabca 100644 --- a/app/Http/Controllers/ContactController.php +++ b/app/Http/Controllers/ContactController.php @@ -6,6 +6,7 @@ use App\Contact; use App\Jobs\ContactPipeline\ContactPipeline; use App\Rules\MaxMultiLine; use Illuminate\Http\Request; +use Illuminate\Support\Facades\Auth; class ContactController extends Controller { @@ -19,7 +20,7 @@ class ContactController extends Controller public function store(Request $request) { abort_if(! config('instance.contact.enabled'), 404); - abort_if(! $request->user(), 403); + abort_if(! Auth::check(), 403); $this->validate($request, [ 'message' => ['required', 'string', 'min:5', new MaxMultiLine('500')], @@ -28,7 +29,7 @@ class ContactController extends Controller $message = $request->input('message'); $request_response = $request->input('request_response') == 'on' ? true : false; - $user = $request->user(); + $user = Auth::user(); $max = config('instance.contact.max_per_day'); $contact = Contact::whereUserId($user->id) diff --git a/app/Http/Controllers/DiscoverController.php b/app/Http/Controllers/DiscoverController.php index 525c82080..51f427078 100644 --- a/app/Http/Controllers/DiscoverController.php +++ b/app/Http/Controllers/DiscoverController.php @@ -21,6 +21,7 @@ use App\Services\TrendingHashtagService; use App\Services\UserFilterService; use App\Status; use Illuminate\Http\Request; +use Illuminate\Support\Facades\Auth; use Illuminate\Support\Facades\Cache; use Illuminate\Support\Facades\DB; @@ -28,7 +29,7 @@ class DiscoverController extends Controller { public function home(Request $request) { - abort_if(! $request->user() && config('instance.discover.public') == false, 403); + abort_if(! Auth::check() && config('instance.discover.public') == false, 403); return view('discover.home'); } @@ -38,7 +39,7 @@ class DiscoverController extends Controller if ($request->user()) { return redirect('/i/web/hashtag/'.$hashtag.'?src=pd'); } - abort_if(! config('instance.discover.tags.is_public') && ! $request->user(), 403); + abort_if(! config('instance.discover.tags.is_public') && ! Auth::check(), 403); $tag = Hashtag::whereName($hashtag) ->orWhere('slug', $hashtag) @@ -179,7 +180,7 @@ class DiscoverController extends Controller ->pluck('id'); }); - $filtered = $request->user() !== null ? UserFilterService::filters($request->user()->profile_id) : []; + $filtered = Auth::check() ? UserFilterService::filters(Auth::user()->profile_id) : []; $res = $ids->map(function ($s) { return StatusService::get($s); diff --git a/app/Http/Controllers/HashtagFollowController.php b/app/Http/Controllers/HashtagFollowController.php index 384430892..9fbc46b91 100644 --- a/app/Http/Controllers/HashtagFollowController.php +++ b/app/Http/Controllers/HashtagFollowController.php @@ -21,7 +21,7 @@ class HashtagFollowController extends Controller 'name' => 'required|alpha_num|min:1|max:124|exists:hashtags,name', ]); - $user = $request->user(); + $user = Auth::user(); $profile = $user->profile; $tag = $request->input('name'); diff --git a/app/Http/Controllers/Import/Instagram.php b/app/Http/Controllers/Import/Instagram.php index 207afb7de..56f677935 100644 --- a/app/Http/Controllers/Import/Instagram.php +++ b/app/Http/Controllers/Import/Instagram.php @@ -6,6 +6,7 @@ use App\ImportData; use App\ImportJob; use App\Jobs\ImportPipeline\ImportInstagram; use Illuminate\Http\Request; +use Illuminate\Support\Facades\Auth; use Illuminate\Support\Facades\DB; use Illuminate\Support\Facades\Log; use Illuminate\Support\Str; @@ -26,7 +27,7 @@ trait Instagram if ((bool) config_cache('pixelfed.import.instagram.enabled') != true) { abort(404, 'Feature not enabled'); } - $completed = ImportJob::whereProfileId($request->user()->profile->id) + $completed = ImportJob::whereProfileId(Auth::user()->profile->id) ->whereService('instagram') ->whereNotNull('completed_at') ->exists(); @@ -43,7 +44,7 @@ trait Instagram if ((bool) config_cache('pixelfed.import.instagram.enabled') != true) { abort(404, 'Feature not enabled'); } - $profile = request()->user()->profile; + $profile = Auth::user()->profile; $exists = ImportJob::whereProfileId($profile->id) ->whereService('instagram') ->whereNull('completed_at') @@ -70,7 +71,7 @@ trait Instagram if ((bool) config_cache('pixelfed.import.instagram.enabled') != true) { abort(404, 'Feature not enabled'); } - $profile = $request->user()->profile; + $profile = Auth::user()->profile; $job = ImportJob::whereProfileId($profile->id) ->whereNull('completed_at') ->whereUuid($uuid) @@ -92,7 +93,7 @@ trait Instagram ]); $media = $request->file('media'); - $profile = $request->user()->profile; + $profile = Auth::user()->profile; $job = ImportJob::whereProfileId($profile->id) ->whereNull('completed_at') ->whereUuid($uuid) @@ -131,7 +132,7 @@ trait Instagram if ((bool) config_cache('pixelfed.import.instagram.enabled') != true) { abort(404, 'Feature not enabled'); } - $profile = $request->user()->profile; + $profile = Auth::user()->profile; $job = ImportJob::whereProfileId($profile->id) ->whereNull('completed_at') ->whereUuid($uuid) @@ -149,7 +150,7 @@ trait Instagram $this->validate($request, [ 'media' => 'required|file|max:1000', ]); - $profile = $request->user()->profile; + $profile = Auth::user()->profile; $job = ImportJob::whereProfileId($profile->id) ->whereNull('completed_at') ->whereUuid($uuid) @@ -175,7 +176,7 @@ trait Instagram if ((bool) config_cache('pixelfed.import.instagram.enabled') != true) { abort(404, 'Feature not enabled'); } - $profile = $request->user()->profile; + $profile = Auth::user()->profile; $job = ImportJob::whereProfileId($profile->id) ->whereService('instagram') ->whereNull('completed_at') @@ -191,7 +192,7 @@ trait Instagram if ((bool) config_cache('pixelfed.import.instagram.enabled') != true) { abort(404, 'Feature not enabled'); } - $profile = $request->user()->profile; + $profile = Auth::user()->profile; try { $import = ImportJob::whereProfileId($profile->id) diff --git a/app/Http/Controllers/InternalApiController.php b/app/Http/Controllers/InternalApiController.php index f3c893220..d423634a0 100644 --- a/app/Http/Controllers/InternalApiController.php +++ b/app/Http/Controllers/InternalApiController.php @@ -20,6 +20,7 @@ use App\Status; // StatusMediaContainerTransformer, use App\Transformer\Api\StatusTransformer; use App\User; use Illuminate\Http\Request; +use Illuminate\Support\Facades\Auth; use Illuminate\Support\Facades\Cache; use Illuminate\Support\Facades\Redis; use Illuminate\Validation\Rule; @@ -68,7 +69,7 @@ class InternalApiController extends Controller public function directMessage(Request $request, $profileId, $threadId) { - $profile = $request->user()->profile; + $profile = Auth::user()->profile; if ($profileId != $profile->id) { abort(403); @@ -133,7 +134,7 @@ class InternalApiController extends Controller public function modAction(Request $request) { - abort_unless($request->user()->is_admin, 400); + abort_unless(Auth::user()->is_admin, 400); $this->validate($request, [ 'action' => [ 'required', @@ -166,7 +167,7 @@ class InternalApiController extends Controller $status->is_nsfw = true; $status->save(); ModLogService::boot() - ->user($request->user()) + ->user(Auth::user()) ->objectUid($status->profile->user_id) ->objectId($status->id) ->objectType('App\Status::class') @@ -211,7 +212,7 @@ class InternalApiController extends Controller $status->is_nsfw = false; $status->save(); ModLogService::boot() - ->user($request->user()) + ->user(Auth::user()) ->objectUid($status->profile->user_id) ->objectId($status->id) ->objectType('App\Status::class') @@ -237,7 +238,7 @@ class InternalApiController extends Controller $status->save(); PublicTimelineService::del($status->id); ModLogService::boot() - ->user($request->user()) + ->user(Auth::user()) ->objectUid($status->profile->user_id) ->objectId($status->id) ->objectType('App\Status::class') @@ -281,7 +282,7 @@ class InternalApiController extends Controller case 'spammer': HandleSpammerPipeline::dispatch($status->profile); ModLogService::boot() - ->user($request->user()) + ->user(Auth::user()) ->objectUid($status->profile->user_id) ->objectId($status->id) ->objectType('App\User::class') @@ -354,10 +355,10 @@ class InternalApiController extends Controller ['photo', 'photo:album', 'video', 'video:album', 'share', 'reply']; if ($profile->is_private) { - if (! $request->user()) { + if (! Auth::check()) { return response()->json([]); } - $pid = $request->user()->profile->id; + $pid = Auth::user()->profile->id; $following = Cache::remember('profile:following:'.$pid, now()->addMinutes(1440), function () use ($pid) { $following = Follower::whereProfileId($pid)->pluck('following_id'); @@ -365,8 +366,8 @@ class InternalApiController extends Controller }); $visibility = in_array($profile->id, $following) == true ? ['public', 'unlisted', 'private'] : []; } else { - if ($request->user() !== null) { - $pid = $request->user()->profile->id; + if (Auth::check()) { + $pid = Auth::user()->profile->id; $following = Cache::remember('profile:following:'.$pid, now()->addMinutes(1440), function () use ($pid) { $following = Follower::whereProfileId($pid)->pluck('following_id'); diff --git a/app/Http/Controllers/MicroController.php b/app/Http/Controllers/MicroController.php index a42440188..9094f6ba7 100644 --- a/app/Http/Controllers/MicroController.php +++ b/app/Http/Controllers/MicroController.php @@ -5,6 +5,7 @@ namespace App\Http\Controllers; use App\Status; use App\Transformer\Api\StatusTransformer; use Illuminate\Http\Request; +use Illuminate\Support\Facades\Auth; use Illuminate\Support\Facades\DB; use Illuminate\Validation\Rule; use League\Fractal\Manager; @@ -39,7 +40,7 @@ class MicroController extends Controller ]), ], ]); - $profile = $request->user()->profile; + $profile = Auth::user()->profile; $title = $request->input('title'); $content = $request->input('content'); $visibility = $request->input('visibility'); diff --git a/app/Http/Controllers/NewsroomController.php b/app/Http/Controllers/NewsroomController.php index 0c6b88f79..9e6e0e4f7 100644 --- a/app/Http/Controllers/NewsroomController.php +++ b/app/Http/Controllers/NewsroomController.php @@ -4,6 +4,7 @@ namespace App\Http\Controllers; use App\Newsroom; use Illuminate\Http\Request; +use Illuminate\Support\Facades\Auth; use Illuminate\Support\Facades\Redis; use Illuminate\Support\Str; @@ -11,7 +12,7 @@ class NewsroomController extends Controller { public function index(Request $request) { - if ($request->user() !== null) { + if (Auth::check()) { $posts = Newsroom::whereNotNull('published_at')->latest()->paginate(9); } else { $posts = Newsroom::whereNotNull('published_at') @@ -52,7 +53,7 @@ class NewsroomController extends Controller public function timelineApi(Request $request) { - abort_if(! $request->user(), 404); + abort_if(! Auth::check(), 404); $key = 'newsroom:read:profileid:'.$request->user()->profile_id; $read = Redis::smembers($key); @@ -78,7 +79,7 @@ class NewsroomController extends Controller public function markAsRead(Request $request) { - abort_if(! $request->user(), 404); + abort_if(! Auth::check(), 404); $this->validate($request, [ 'id' => 'required|integer|min:1', diff --git a/app/Http/Controllers/ProfileController.php b/app/Http/Controllers/ProfileController.php index c3f39ef8a..ebcf59572 100644 --- a/app/Http/Controllers/ProfileController.php +++ b/app/Http/Controllers/ProfileController.php @@ -66,7 +66,7 @@ class ProfileController extends Controller { $carousel = (bool) $request->filled('carousel'); $username = $user->username; - $loggedIn = $request->user() !== null; + $loggedIn = Auth::check(); $isPrivate = false; $isBlocked = false; if (! $loggedIn) { @@ -117,10 +117,10 @@ class ProfileController extends Controller $isBlocked = $this->blockedProfileCheck($user); $owner = $loggedIn && Auth::id() === $user->user_id; - $is_following = ($owner == false && $request->user() !== null) ? $user->followedBy($request->user()->profile) : false; + $is_following = ($owner == false && Auth::check()) ? $user->followedBy(Auth::user()->profile) : false; if ($isPrivate == true || $isBlocked == true) { - $requested = $request->user() !== null ? FollowRequest::whereFollowerId($request->user()->profile_id) + $requested = Auth::check() ? FollowRequest::whereFollowerId(Auth::user()->profile_id) ->whereFollowingId($user->id) ->exists() : false; @@ -187,11 +187,11 @@ class ProfileController extends Controller protected function privateProfileCheck(Profile $profile, $loggedIn) { - if (! request()->user()) { + if (! Auth::check()) { return true; } - $user = request()->user()->profile; + $user = Auth::user()->profile; if ($user->id == $profile->id || ! $profile->is_private) { return false; } @@ -221,7 +221,7 @@ class ProfileController extends Controller protected function blockedProfileCheck(Profile $profile) { - $pid = request()->user()->profile->id; + $pid = Auth::user()->profile->id; $blocks = UserFilter::whereUserId($profile->id) ->whereFilterType('block') ->whereFilterableType(Profile::class) @@ -330,11 +330,11 @@ class ProfileController extends Controller ->withHeaders($data['headers']); } - public function meRedirect(Request $request) + public function meRedirect() { - abort_if(! $request->user(), 404); + abort_if(! Auth::check(), 404); - return redirect($request->user()->url()); + return redirect(Auth::user()->url()); } public function embed(Request $request, $username) @@ -383,7 +383,7 @@ class ProfileController extends Controller abort_if(! (bool) config_cache('instance.stories.enabled') || ! $request->user(), 404); $profile = Profile::whereNull('domain')->whereUsername($username)->firstOrFail(); $pid = $profile->id; - $authed = $request->user()->profile_id; + $authed = Auth::user()->profile_id; abort_if($pid != $authed && ! FollowerService::follows($authed, $pid), 404); $exists = Story::whereProfileId($pid) ->whereActive(true) diff --git a/app/Http/Controllers/PublicApiController.php b/app/Http/Controllers/PublicApiController.php index 449c147e6..402dfd567 100644 --- a/app/Http/Controllers/PublicApiController.php +++ b/app/Http/Controllers/PublicApiController.php @@ -19,6 +19,7 @@ use App\Services\UserFilterService; use App\Status; use App\Transformer\Api\StatusStatelessTransformer; use Illuminate\Http\Request; +use Illuminate\Support\Facades\Auth; use Illuminate\Support\Facades\Cache; use League\Fractal; use League\Fractal\Pagination\IlluminatePaginatorAdapter; @@ -92,7 +93,7 @@ class PublicApiController extends Controller $profile = Profile::whereUsername($username)->whereNull('status')->firstOrFail(); $status = Status::whereProfileId($profile->id)->findOrFail($postid); $this->scopeCheck($profile, $status); - if (! $request->user()) { + if (! Auth::check()) { $res = [ 'user' => [], 'likes' => [], @@ -133,8 +134,8 @@ class PublicApiController extends Controller $status = Status::whereProfileId($profile->id)->whereCommentsDisabled(false)->findOrFail($postId); $this->scopeCheck($profile, $status); - if ($request->user() !== null) { - $p = $request->user()->profile; + if (Auth::check()) { + $p = Auth::user()->profile; $scope = $p->id == $status->profile_id || FollowerService::follows($p->id, $profile->id) ? ['public', 'private', 'unlisted'] : ['public', 'unlisted']; } else { $scope = ['public', 'unlisted']; @@ -177,7 +178,7 @@ class PublicApiController extends Controller protected function scopeCheck(Profile $profile, Status $status) { - if ($profile->is_private == true && ! request()->user()) { + if ($profile->is_private == true && Auth::check() == false) { abort(404); } @@ -186,7 +187,7 @@ class PublicApiController extends Controller case 'unlisted': break; case 'private': - $user = request()->user() !== null ? request()->user() : false; + $user = Auth::check() ? Auth::user() : false; if (! $user) { abort(403); } else { @@ -633,7 +634,7 @@ class PublicApiController extends Controller public function relationships(Request $request) { - if (! $request->user()) { + if (! Auth::check()) { return response()->json([]); } diff --git a/app/Http/Controllers/ReportController.php b/app/Http/Controllers/ReportController.php index bd30f1a9b..b4401a73f 100644 --- a/app/Http/Controllers/ReportController.php +++ b/app/Http/Controllers/ReportController.php @@ -116,7 +116,7 @@ class ReportController extends Controller 'msg' => 'nullable|string|max:150', ]); - $profile = $request->user()->profile; + $profile = Auth::user()->profile; $reportType = $request->input('report'); $object_id = $request->input('id'); $object_type = $request->input('type'); diff --git a/app/Http/Controllers/Settings/ExportSettings.php b/app/Http/Controllers/Settings/ExportSettings.php index 25b2447a9..6e0d8e50d 100644 --- a/app/Http/Controllers/Settings/ExportSettings.php +++ b/app/Http/Controllers/Settings/ExportSettings.php @@ -29,9 +29,9 @@ trait ExportSettings return view('settings.dataexport'); } - public function exportAccount(Request $request) + public function exportAccount() { - $profile = $request->user()->profile; + $profile = Auth::user()->profile; $fractal = new Fractal\Manager; $fractal->setSerializer(new ArraySerializer); $resource = new Fractal\Resource\Item($profile, new ProfileTransformer); @@ -45,9 +45,9 @@ trait ExportSettings ]); } - public function exportFollowing(Request $request) + public function exportFollowing() { - $profile = $request->user()->profile; + $profile = Auth::user()->profile; $userId = Auth::id(); $userExportPath = 'user_exports/'.$userId; @@ -109,9 +109,9 @@ trait ExportSettings } } - public function exportFollowers(Request $request) + public function exportFollowers() { - $profile = $request->user()->profile; + $profile = Auth::user()->profile; $userId = Auth::id(); $userExportPath = 'user_exports/'.$userId; @@ -173,16 +173,16 @@ trait ExportSettings } } - public function exportMuteBlockList(Request $request) + public function exportMuteBlockList() { - $profile = $request->user()->profile; + $profile = Auth::user()->profile; $exists = UserFilter::select('id') ->whereUserId($profile->id) ->exists(); if (! $exists) { return redirect()->back(); } - $data = Cache::remember('account:export:profile:muteblocklist:'.$request->user()->profile->id, now()->addMinutes(60), function () use ($profile) { + $data = Cache::remember('account:export:profile:muteblocklist:'.Auth::user()->profile->id, now()->addMinutes(60), function () use ($profile) { return json_encode([ 'muted' => $profile->mutedProfileUrls(), 'blocked' => $profile->blockedProfileUrls(), @@ -198,7 +198,7 @@ trait ExportSettings public function exportStatuses(Request $request) { - $profile = $request->user()->profile; + $profile = Auth::user()->profile; $userId = Auth::id(); $userExportPath = self::STORAGE_BASE.'/'.$userId; $filename = 'pixelfed-statuses.json'; diff --git a/app/Http/Controllers/Settings/HomeSettings.php b/app/Http/Controllers/Settings/HomeSettings.php index 0f57f9587..cb9969e5e 100644 --- a/app/Http/Controllers/Settings/HomeSettings.php +++ b/app/Http/Controllers/Settings/HomeSettings.php @@ -20,9 +20,9 @@ use Purify; trait HomeSettings { - public function home(Request $request) + public function home() { - $id = $request->user()->profile_id; + $id = Auth::user()->profile_id; $storage = []; $used = Media::whereProfileId($id)->sum('size'); $storage['limit'] = config_cache('pixelfed.max_account_size') * 1024; @@ -50,7 +50,7 @@ trait HomeSettings $bio = $request->filled('bio') ? strip_tags(Purify::clean($request->input('bio'))) : null; $website = $request->input('website'); $language = $request->input('language'); - $user = $request->user(); + $user = Auth::user(); $profile = $user->profile; $pronouns = $request->input('pronouns'); $existingPronouns = PronounService::get($profile->id); @@ -176,7 +176,7 @@ trait HomeSettings ]); $changes = false; $email = $request->input('email'); - $user = $request->user(); + $user = Auth::user(); $profile = $user->profile; $validate = config_cache('pixelfed.enforce_email_verification'); diff --git a/app/Http/Controllers/Settings/PrivacySettings.php b/app/Http/Controllers/Settings/PrivacySettings.php index 4cab7b921..0e5f0793a 100644 --- a/app/Http/Controllers/Settings/PrivacySettings.php +++ b/app/Http/Controllers/Settings/PrivacySettings.php @@ -9,14 +9,15 @@ use App\Services\AccountService; use App\Services\RelationshipService; use App\UserFilter; use Illuminate\Http\Request; +use Illuminate\Support\Facades\Auth; use Illuminate\Support\Facades\Cache; use Illuminate\Support\Facades\DB; trait PrivacySettings { - public function privacy(Request $request) + public function privacy() { - $user = $request->user(); + $user = Auth::user(); $settings = $user->settings; $profile = $user->profile; $is_private = $profile->is_private; @@ -114,9 +115,9 @@ trait PrivacySettings return redirect(route('settings.privacy'))->with('status', 'Settings successfully updated!'); } - public function mutedUsers(Request $request) + public function mutedUsers() { - $pid = $request->user()->profile->id; + $pid = Auth::user()->profile->id; $ids = (new UserFilter)->mutedUserIds($pid); $users = Profile::whereIn('id', $ids)->simplePaginate(15); @@ -129,7 +130,7 @@ trait PrivacySettings 'profile_id' => 'required|integer|min:1', ]); $fid = $request->input('profile_id'); - $pid = $request->user()->profile->id; + $pid = Auth::user()->profile->id; DB::transaction(function () use ($fid, $pid) { $filter = UserFilter::whereUserId($pid) ->whereFilterableId($fid) @@ -143,9 +144,9 @@ trait PrivacySettings return redirect()->back(); } - public function blockedUsers(Request $request) + public function blockedUsers() { - $pid = $request->user()->profile->id; + $pid = Auth::user()->profile->id; $ids = (new UserFilter)->blockedUserIds($pid); $users = Profile::whereIn('id', $ids)->simplePaginate(15); @@ -158,7 +159,7 @@ trait PrivacySettings 'profile_id' => 'required|integer|min:1', ]); $fid = $request->input('profile_id'); - $pid = $request->user()->profile->id; + $pid = Auth::user()->profile->id; DB::transaction(function () use ($fid, $pid) { $filter = UserFilter::whereUserId($pid) ->whereFilterableId($fid) @@ -210,8 +211,8 @@ trait PrivacySettings $duration = $request->input('duration'); // $newRequests = $request->input('newrequests'); - $profile = $request->user()->profile; - $settings = $request->user()->settings; + $profile = Auth::user()->profile; + $settings = Auth::user()->settings; if ($mode !== 'keep-all') { switch ($mode) { diff --git a/app/Http/Controllers/Settings/RelationshipSettings.php b/app/Http/Controllers/Settings/RelationshipSettings.php index e3a8fec5d..435349738 100644 --- a/app/Http/Controllers/Settings/RelationshipSettings.php +++ b/app/Http/Controllers/Settings/RelationshipSettings.php @@ -3,6 +3,7 @@ namespace App\Http\Controllers\Settings; use Illuminate\Http\Request; +use Illuminate\Support\Facades\Auth; trait RelationshipSettings { @@ -13,7 +14,7 @@ trait RelationshipSettings ]); $mode = $request->input('mode') ?? 'followers'; - $profile = $request->user()->profile; + $profile = Auth::user()->profile; switch ($mode) { case 'following': diff --git a/app/Http/Controllers/Settings/SecuritySettings.php b/app/Http/Controllers/Settings/SecuritySettings.php index 551f37fcc..285b16f5c 100644 --- a/app/Http/Controllers/Settings/SecuritySettings.php +++ b/app/Http/Controllers/Settings/SecuritySettings.php @@ -10,14 +10,15 @@ use BaconQrCode\Renderer\RendererStyle\RendererStyle; use BaconQrCode\Writer; use Carbon\Carbon; use Illuminate\Http\Request; +use Illuminate\Support\Facades\Auth; use Illuminate\Support\Str; use PragmaRX\Google2FA\Google2FA; trait SecuritySettings { - public function security(Request $request) + public function security() { - $user = $request->user(); + $user = Auth::user(); $activity = AccountLog::whereUserId($user->id) ->orderBy('created_at', 'desc') @@ -34,7 +35,7 @@ trait SecuritySettings public function securityTwoFactorSetup(Request $request) { - $user = $request->user(); + $user = Auth::user(); if ($user->{'2fa_enabled'} && $user->{'2fa_secret'}) { return redirect(route('account.security')); } @@ -76,7 +77,7 @@ trait SecuritySettings public function securityTwoFactorSetupStore(Request $request) { - $user = $request->user(); + $user = Auth::user(); if ($user->{'2fa_enabled'} && $user->{'2fa_secret'}) { abort(403, 'Two factor auth is already setup.'); } @@ -99,7 +100,7 @@ trait SecuritySettings public function securityTwoFactorEdit(Request $request) { - $user = $request->user(); + $user = Auth::user(); if (! $user->{'2fa_enabled'} || ! $user->{'2fa_secret'}) { abort(403); @@ -110,7 +111,7 @@ trait SecuritySettings public function securityTwoFactorRecoveryCodes(Request $request) { - $user = $request->user(); + $user = Auth::user(); if (! $user->{'2fa_enabled'} || ! $user->{'2fa_secret'} || ! $user->{'2fa_backup_codes'}) { abort(403); @@ -122,7 +123,7 @@ trait SecuritySettings public function securityTwoFactorRecoveryCodesRegenerate(Request $request) { - $user = $request->user(); + $user = Auth::user(); if (! $user->{'2fa_enabled'} || ! $user->{'2fa_secret'}) { abort(403); @@ -136,7 +137,7 @@ trait SecuritySettings public function securityTwoFactorUpdate(Request $request) { - $user = $request->user(); + $user = Auth::user(); if (! $user->{'2fa_enabled'} || ! $user->{'2fa_secret'} || ! $user->{'2fa_backup_codes'}) { abort(403); diff --git a/app/Http/Controllers/SettingsController.php b/app/Http/Controllers/SettingsController.php index 7482ca01b..99af6cf93 100644 --- a/app/Http/Controllers/SettingsController.php +++ b/app/Http/Controllers/SettingsController.php @@ -37,9 +37,9 @@ class SettingsController extends Controller $this->middleware('auth'); } - public function accessibility(Request $request) + public function accessibility() { - $settings = $request->user()->settings; + $settings = Auth::user()->settings; return view('settings.accessibility', compact('settings')); } @@ -96,7 +96,7 @@ class SettingsController extends Controller public function removeAccountTemporary(Request $request) { - $user = $request->user(); + $user = Auth::user(); abort_if(! config('pixelfed.account_deletion'), 403); abort_if($user->is_admin, 403); @@ -105,7 +105,7 @@ class SettingsController extends Controller public function removeAccountTemporarySubmit(Request $request) { - $user = $request->user(); + $user = Auth::user(); abort_if(! config('pixelfed.account_deletion'), 403); abort_if($user->is_admin, 403); $profile = $user->profile; @@ -121,7 +121,7 @@ class SettingsController extends Controller public function removeAccountPermanent(Request $request) { - $user = $request->user(); + $user = Auth::user(); abort_if($user->is_admin, 403); return view('settings.remove.permanent'); @@ -132,7 +132,7 @@ class SettingsController extends Controller if (config('pixelfed.account_deletion') == false) { abort(404); } - $user = $request->user(); + $user = Auth::user(); abort_if(! config('pixelfed.account_deletion'), 403); abort_if($user->is_admin, 403); @@ -163,7 +163,7 @@ class SettingsController extends Controller public function requestFullExport(Request $request) { - $user = $request->user(); + $user = Auth::user(); return view('settings.export.show'); } @@ -185,14 +185,14 @@ class SettingsController extends Controller return response()->json([200])->cookie($cookie); } - public function sponsor(Request $request) + public function sponsor() { $default = [ 'patreon' => null, 'liberapay' => null, 'opencollective' => null, ]; - $sponsors = ProfileSponsor::whereProfileId($request->user()->profile->id)->first(); + $sponsors = ProfileSponsor::whereProfileId(Auth::user()->profile->id)->first(); $sponsors = $sponsors ? json_decode($sponsors->sponsors, true) : $default; return view('settings.sponsor', compact('sponsors')); @@ -233,7 +233,7 @@ class SettingsController extends Controller ]; $sponsors = ProfileSponsor::firstOrCreate([ - 'profile_id' => $request->user()->profile_id ?? $request->user()->profile->id, + 'profile_id' => Auth::user()->profile_id ?? Auth::user()->profile->id, ]); $sponsors->sponsors = json_encode($res); $sponsors->save(); diff --git a/app/Http/Controllers/SiteController.php b/app/Http/Controllers/SiteController.php index f9a4e5076..8f9f2089d 100644 --- a/app/Http/Controllers/SiteController.php +++ b/app/Http/Controllers/SiteController.php @@ -10,6 +10,7 @@ use App\User; use App\Util\ActivityPub\Helpers; use App\Util\Localization\Localization; use Illuminate\Http\Request; +use Illuminate\Support\Facades\Auth; use Illuminate\Support\Facades\Cache; use Illuminate\Support\Facades\View; use Illuminate\Support\Str; @@ -18,7 +19,7 @@ class SiteController extends Controller { public function home(Request $request) { - if ($request->user() !== null) { + if (Auth::check()) { return $this->homeTimeline($request); } else { return $this->homeGuest(); diff --git a/app/Http/Controllers/StatusController.php b/app/Http/Controllers/StatusController.php index 4ed7a8684..6d1175126 100644 --- a/app/Http/Controllers/StatusController.php +++ b/app/Http/Controllers/StatusController.php @@ -18,6 +18,7 @@ use App\Transformer\ActivityPub\Verb\Note; use App\Transformer\ActivityPub\Verb\Question; use App\Util\Media\License; use Illuminate\Http\Request; +use Illuminate\Support\Facades\Auth; use Illuminate\Support\Facades\Cache; use Illuminate\Support\Facades\DB; use League\Fractal; @@ -220,10 +221,10 @@ class StatusController extends Controller abort_if($status->uri, 404); if ($status->visibility == 'private' || $user->is_private) { - if (! $request->user()) { + if (! Auth::check()) { abort(403); } - $pid = $request->user()->profile; + $pid = Auth::user()->profile; if ($user->followedBy($pid) == false && $user->id !== $pid->id) { abort(403); } @@ -251,7 +252,7 @@ class StatusController extends Controller $status = Status::findOrFail($request->input('item')); - $user = $request->user(); + $user = Auth::user(); if ( $status->profile_id != $user->profile->id && @@ -320,7 +321,7 @@ class StatusController extends Controller 'item' => 'required|integer|min:1', ]); - $user = $request->user(); + $user = Auth::user(); $profile = $user->profile; $status = Status::whereScope('public') ->findOrFail($request->input('item')); @@ -329,11 +330,11 @@ class StatusController extends Controller $count = $status->reblogs_count; $defaultCaption = config_cache('database.default') === 'mysql' ? null : ''; - $exists = Status::whereProfileId($request->user()->profile->id) + $exists = Status::whereProfileId(Auth::user()->profile->id) ->whereReblogOfId($status->id) ->exists(); if ($exists == true) { - $shares = Status::whereProfileId($request->user()->profile->id) + $shares = Status::whereProfileId(Auth::user()->profile->id) ->whereReblogOfId($status->id) ->get(); foreach ($shares as $share) { @@ -385,7 +386,7 @@ class StatusController extends Controller public function edit(Request $request, $username, $id) { $this->authCheck(); - $user = $request->user()->profile; + $user = Auth::user()->profile; $status = Status::whereProfileId($user->id) ->with(['media']) ->findOrFail($id); @@ -397,7 +398,7 @@ class StatusController extends Controller public function editStore(Request $request, $username, $id) { $this->authCheck(); - $user = $request->user()->profile; + $user = Auth::user()->profile; $status = Status::whereProfileId($user->id) ->with(['media']) ->findOrFail($id); @@ -419,7 +420,7 @@ class StatusController extends Controller protected function authCheck() { - if (! request()->user()) { + if (Auth::check() == false) { abort(403); } } @@ -478,7 +479,7 @@ class StatusController extends Controller 'disableComments' => 'required|boolean', ]); - $user = $request->user(); + $user = Auth::user(); $id = $request->input('item'); $state = $request->input('disableComments'); diff --git a/app/Http/Controllers/TimelineController.php b/app/Http/Controllers/TimelineController.php index a486ac671..c4b219f3b 100644 --- a/app/Http/Controllers/TimelineController.php +++ b/app/Http/Controllers/TimelineController.php @@ -7,6 +7,7 @@ use App\Status; use App\Transformer\Api\StatusTimelineTransformer; use App\UserFilter; use Illuminate\Http\Request; +use Illuminate\Support\Facades\Auth; use Illuminate\Support\Facades\Cache; use League\Fractal; use League\Fractal\Serializer\ArraySerializer; @@ -53,7 +54,7 @@ class TimelineController extends Controller 'limit' => 'nullable|integer|max:30', ]); - if (config('instance.timeline.local.is_public') == false && ! $request->user()) { + if (config('instance.timeline.local.is_public') == false && ! Auth::check()) { abort(403, 'Authentication required.'); } diff --git a/app/Http/Controllers/UserInviteController.php b/app/Http/Controllers/UserInviteController.php index 94d97c8ce..b0b1efc66 100644 --- a/app/Http/Controllers/UserInviteController.php +++ b/app/Http/Controllers/UserInviteController.php @@ -16,7 +16,7 @@ class UserInviteController extends Controller public function create(Request $request) { abort_if(! config('pixelfed.user_invites.enabled'), 404); - abort_unless($request->user() !== null, 403); + abort_unless(Auth::check(), 403); return view('settings.invites.create'); } @@ -24,7 +24,7 @@ class UserInviteController extends Controller public function show(Request $request) { abort_if(! config('pixelfed.user_invites.enabled'), 404); - abort_unless($request->user() !== null, 403); + abort_unless(Auth::check(), 403); $invites = UserInvite::whereUserId(Auth::id())->paginate(10); $limit = config('pixelfed.user_invites.limit.total'); $used = UserInvite::whereUserId(Auth::id())->count(); @@ -35,7 +35,7 @@ class UserInviteController extends Controller public function store(Request $request) { abort_if(! config('pixelfed.user_invites.enabled'), 404); - abort_unless($request->user() !== null, 403); + abort_unless(Auth::check(), 403); $this->validate($request, [ 'email' => 'required|email|unique:users|unique:user_invites', 'message' => 'nullable|string|max:500', @@ -53,7 +53,7 @@ class UserInviteController extends Controller $invite = new UserInvite; $invite->user_id = Auth::id(); - $invite->profile_id = $request->user()->profile_id; + $invite->profile_id = Auth::user()->profile_id; $invite->email = $email; $invite->message = $request->input('message'); $invite->key = Str::random(random_int(6, 9)).'_'.Str::random(random_int(14, 20)).'_'.Str::random(random_int(32, 64)); diff --git a/app/Http/Middleware/AccountInterstitial.php b/app/Http/Middleware/AccountInterstitial.php index c1c9d5cbe..0e77f0109 100644 --- a/app/Http/Middleware/AccountInterstitial.php +++ b/app/Http/Middleware/AccountInterstitial.php @@ -4,6 +4,7 @@ namespace App\Http\Middleware; use Closure; use Illuminate\Http\Request; +use Illuminate\Support\Facades\Auth; class AccountInterstitial { @@ -28,7 +29,7 @@ class AccountInterstitial 'site/kb/community-guidelines', ]; - if ($request->user() !== null && ! $request->is($ar)) { + if (Auth::check() && ! $request->is($ar)) { if ($request->user()->has_interstitial) { if ($request->wantsJson()) { $res = ['_refresh' => true, 'error' => 403, 'message' => \App\AccountInterstitial::JSON_MESSAGE]; diff --git a/app/Http/Middleware/Admin.php b/app/Http/Middleware/Admin.php index f83697bc1..135e5a9fa 100644 --- a/app/Http/Middleware/Admin.php +++ b/app/Http/Middleware/Admin.php @@ -4,6 +4,7 @@ namespace App\Http\Middleware; use Closure; use Illuminate\Http\Request; +use Illuminate\Support\Facades\Auth; class Admin { @@ -15,7 +16,7 @@ class Admin */ public function handle($request, Closure $next) { - if (! $request->user() || $request->user()->is_admin == false) { + if (Auth::check() == false || Auth::user()->is_admin == false) { return redirect(config('app.url')); } diff --git a/app/Http/Middleware/Api/Admin.php b/app/Http/Middleware/Api/Admin.php index 43ee3d06b..3b7f0e9e8 100644 --- a/app/Http/Middleware/Api/Admin.php +++ b/app/Http/Middleware/Api/Admin.php @@ -4,6 +4,7 @@ namespace App\Http\Middleware\Api; use Closure; use Illuminate\Http\Request; +use Illuminate\Support\Facades\Auth; class Admin { @@ -15,7 +16,7 @@ class Admin */ public function handle($request, Closure $next) { - if (! $request->user() || $request->user()->is_admin == false) { + if (Auth::check() == false || Auth::user()->is_admin == false) { return abort(403, 'You must be an administrator to do that'); } diff --git a/app/Http/Middleware/DangerZone.php b/app/Http/Middleware/DangerZone.php index c132e9740..53b825c65 100644 --- a/app/Http/Middleware/DangerZone.php +++ b/app/Http/Middleware/DangerZone.php @@ -29,7 +29,7 @@ class DangerZone return redirect(route('login')); } - if (! $request->user()) { + if (! Auth::check()) { return redirect(route('login')); } if (! $request->is('i/auth/sudo') && $request->session()->get('sudoTrustDevice') != 1) {