Merge pull request #7161 from shleeable/fix/admin-controllers-dangerzone-middleware

Require dangerzone sudo mode on curated register, shadow filter and page admin controllers

app/Http/Controllers/AdminCuratedRegisterController.php

@@ -21,7 +21,7 @@ class AdminCuratedRegisterController extends Controller
 {
     public function __construct()
     {
-        $this->middleware(['auth', 'admin']);
+        $this->middleware(['auth', 'admin', 'dangerzone']);
     }
 
     public function index(Request $request): View

app/Http/Controllers/AdminShadowFilterController.php

@@ -12,7 +12,7 @@ class AdminShadowFilterController extends Controller
 {
     public function __construct()
     {
-        $this->middleware(['auth', 'admin']);
+        $this->middleware(['auth', 'admin', 'dangerzone']);
     }
 
     public function home(Request $request)

app/Http/Controllers/PageController.php

@@ -15,7 +15,7 @@ class PageController extends Controller
 {
     public function __construct()
     {
-        $this->middleware(['auth', 'admin']);
+        $this->middleware(['auth', 'admin', 'dangerzone']);
     }
 
     protected function cacheKeys(): array

routes/web-admin.php

@@ -117,7 +117,6 @@ Route::domain(config('pixelfed.domain.admin'))->prefix('i/admin')->group(functio
     Route::post('asf/edit/{id}', [AdminShadowFilterController::class, 'storeEdit']);
     Route::post('asf/create', [AdminShadowFilterController::class, 'store']);
 
-    Route::get('asf/home', [AdminShadowFilterController::class, 'home']);
     Route::redirect('curated-onboarding/', 'curated-onboarding/home');
     Route::get('curated-onboarding/home', [AdminCuratedRegisterController::class, 'index'])->name('admin.curated-onboarding');
     Route::get('curated-onboarding/templates', [AdminCuratedRegisterController::class, 'templates'])->name('admin.curated-onboarding.templates');

tests/Feature/Security/AdminControllerDangerzoneMiddlewareTest.php

@@ -0,0 +1,37 @@
+<?php
+
+use App\Http\Controllers\AdminCuratedRegisterController;
+use App\Http\Controllers\AdminShadowFilterController;
+use App\Http\Controllers\PageController;
+
+/*
+|--------------------------------------------------------------------------
+| Admin controllers must enforce sudo mode
+|--------------------------------------------------------------------------
+|
+| AdminController applies the `dangerzone` (sudo mode / RequirePassword)
+| middleware to every admin route. Controllers that expose equally sensitive
+| admin operations must do the same so a stolen long-lived session cannot be
+| used to modify pages, shadow-filter users, or approve registrations without
+| a recent password confirmation.
+|
+*/
+
+function controllerMiddleware(object $controller): array
+{
+    return collect($controller->getMiddleware())
+        ->pluck('middleware')
+        ->all();
+}
+
+it('requires dangerzone middleware on PageController', function () {
+    expect(controllerMiddleware(new PageController))->toContain('dangerzone');
+});
+
+it('requires dangerzone middleware on AdminShadowFilterController', function () {
+    expect(controllerMiddleware(new AdminShadowFilterController))->toContain('dangerzone');
+});
+
+it('requires dangerzone middleware on AdminCuratedRegisterController', function () {
+    expect(controllerMiddleware(new AdminCuratedRegisterController))->toContain('dangerzone');
+});