Snapshot of main at 9f39a6e1e (2026-11-02)

app/Http/Responses/LoginResponse.php

@@ -0,0 +1,106 @@
+<?php
+
+namespace App\Http\Responses;
+
+use Illuminate\Support\Facades\Auth;
+use Laravel\Fortify\Contracts\LoginResponse as LoginResponseContract;
+use Mcamara\LaravelLocalization\Facades\LaravelLocalization;
+
+class LoginResponse implements LoginResponseContract
+{
+    public function toResponse($request)
+    {
+        $user = Auth::guard('web')->user();
+        $locale = $user ? $user->lang_preference : null;
+        $localizedRoute = null;
+
+        if ($locale) {
+            $localizedRoute = LaravelLocalization::getURLFromRouteNameTranslated($locale, 'routes.main');
+        }
+
+        // Check if there's an intended URL
+        $intendedUrl = session('url.intended');
+
+        \Log::info('LoginResponse: Checking intended URL', [
+            'intended_url' => $intendedUrl,
+        ]);
+
+        // Define allowed patterns for intended redirects
+        $allowedPatterns = [
+            // Direct profile login pages
+            '/user/' . '.*' . '/login',
+            '/organization/' . '.*' . '/login',
+            '/bank/' . '.*' . '/login',
+            '/admin/' . '.*' . '/login',
+            // Public profile view pages (translated routes)
+            '/profil/utilisateur/',  // French
+            '/profiel/gebruiker/',   // Dutch
+            '/perfil/usuario/',      // Spanish
+            '/perfil/usuário/',      // Portuguese
+            '/profil/benutzer/',     // German
+            '/profile/user/',        // English
+            '/profiel/organisatie/', // Dutch organization
+            '/profil/organisation/', // French/German organization
+            '/perfil/organización/', // Spanish organization
+            '/profile/organization/', // English organization
+            // Public post/article/event pages (translated routes)
+            '/artikel/',             // Dutch article
+            '/article/',             // French/English article
+            '/articulo/',            // Spanish article
+            '/artigo/',              // Portuguese article
+            '/post/',                // English post
+            // Chat/messenger pages
+            '/chats',                // Chat messenger pages
+            // Call pages
+            '/call/',                // English call
+            '/oproep/',              // Dutch call
+            '/appel/',               // French call
+            '/aufruf/',              // German call
+            '/llamada/',             // Spanish call
+            // Poll pages (translated routes), e.g. from a mailing's "Take part" button
+            '/poll/',                // English poll
+            '/peiling/',             // Dutch poll
+            '/umfrage/',             // German poll
+            '/encuesta/',            // Spanish poll
+            '/sondage/',             // French poll
+            // Legacy Cyclos payment links (Lekkernasuh)
+            '/do/member/payment',
+        ];
+
+        // Check if intended URL matches allowed patterns
+        $shouldRedirectToIntended = false;
+        if ($intendedUrl) {
+            foreach ($allowedPatterns as $pattern) {
+                if (preg_match('#' . $pattern . '#', $intendedUrl)) {
+                    $shouldRedirectToIntended = true;
+                    break;
+                }
+            }
+        }
+
+        if ($shouldRedirectToIntended) {
+            // Clear the intended URL from session
+            session()->forget('url.intended');
+
+            \Log::info('LoginResponse: Redirecting to intended URL', [
+                'redirect_to' => $intendedUrl,
+            ]);
+
+            // Back to a poll: let that poll page switch to the profile that may take part, once.
+            // A session marker, not a URL parameter, so a link cannot trigger it (security audit R2).
+            $path = parse_url($intendedUrl, PHP_URL_PATH) ?? '';
+            if (preg_match('#/(poll|peiling|umfrage|encuesta|sondage)/[^/?]+$#', $path)) {
+                session(['poll_switch_after_login' => $path]);
+            }
+
+            return redirect($intendedUrl);
+        }
+
+        // Default redirect to main page after login
+        // Don't use intended() for other URLs to avoid security issues
+        return $request->wantsJson()
+                    ? response()->json(['two_factor' => false])
+                    : redirect($localizedRoute ?: route('main'));
+    }
+
+}

app/Http/Responses/PasswordResetResponse.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Http\Responses;
+
+use Illuminate\Http\JsonResponse;
+use Laravel\Fortify\Contracts\PasswordResetResponse as PasswordResetResponseContract;
+use Mcamara\LaravelLocalization\Facades\LaravelLocalization;
+
+class PasswordResetResponse implements PasswordResetResponseContract
+{
+    protected $status;
+
+    public function __construct(string $status)
+    {
+        $this->status = $status;
+    }
+
+    public function toResponse($request)
+    {
+        if ($request->wantsJson()) {
+            return new JsonResponse(['message' => trans($this->status)], 200);
+        }
+
+        $mainUrl = LaravelLocalization::localizeURL(route('main'));
+
+        return redirect($mainUrl)->with('notification', true)
+            ->with('notification.success', __('passwords.reset'));
+    }
+}