From 519b1b94dc57668ce206056fd01ffd048bcbbd3b Mon Sep 17 00:00:00 2001 From: Shlee Date: Wed, 9 Sep 2026 22:49:12 +0930 Subject: [PATCH] Refactor comments in DangerZone middleware Removed redundant comments to clarify code functionality. --- app/Http/Middleware/DangerZone.php | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/app/Http/Middleware/DangerZone.php b/app/Http/Middleware/DangerZone.php index 3f6fe36a7..fac349e2b 100644 --- a/app/Http/Middleware/DangerZone.php +++ b/app/Http/Middleware/DangerZone.php @@ -17,19 +17,13 @@ class DangerZone */ public function handle($request, Closure $next) { - // Only OIDC-registered users have a random unknown password and cannot - // complete sudo-mode password confirmation. Bypassing on the instance - // flag alone would drop sudo protection for local users (who have real - // passwords) on any OIDC-enabled instance. + // Only OIDC-registered users have a random unknown password and cannot complete sudo-mode password confirmation. if (config('remote-auth.oidc.enabled') && $request->user() && $request->user()->register_source === 'oidc') { return $next($request); } if ($request->session()->get('sudoModeAttempts') > 3) { - // Invalidate the whole session so no security-related flags survive - // the forced logout. Pulling only redirectNext/sudoModeAttempts left - // 2fa.session.active (and sudoMode) intact, which allowed the next - // login on the same session to skip the 2FA checkpoint. + // Invalidate the whole session Auth::logout(); $request->session()->invalidate();