Vasyka
b9d096fa59
The previous POST-based switcher failed silently: CSRF token check
returned 419 when clicking, and the session never persisted.
Root causes:
- POST requires @csrf token, but the test path fetched pages that had
no matching form so the token in the DOM didn't match the session
- Some tenant subdomains had SESSION_DOMAIN scoped differently, so
the cookie set by POST didn't come back on the follow-up GET
- Prod .env had APP_LOCALE=en which took precedence over the config
edit; when session had no locale yet, defaulted to English
Fixes:
1. Route accepts BOTH GET and POST via Route::match(['get', 'post']).
Setting your own language is not a security concern — GET is fine.
2. Route explicitly calls $request->session()->save() before redirect,
forcing the session store to write before the redirect fires.
Also honors ?redirect=<url> query so the user lands back on their
original page rather than referer-guessing.
3. lang-switcher partial rewrites to plain <a href> tags (no @csrf,
no forms). Each link points at /locale/{code}?redirect={current-url}
so the switch happens in a single hop with predictable target.
4. SetLocale middleware hard-codes 'ro' as the ultimate fallback,
ignoring config/env. The Romanian portal is the default
client-facing surface; if a client has no session locale set and
no user account, they see Romanian (safer than English which has
no portal translations).
Suite: 306 passed (853 assertions). Unchanged.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
38 lines
1.7 KiB
PHP
38 lines
1.7 KiB
PHP
@php
|
|
$locales = [
|
|
'ro' => ['label' => 'RO', 'full' => 'Română'],
|
|
'ru' => ['label' => 'RU', 'full' => 'Русский'],
|
|
'en' => ['label' => 'EN', 'full' => 'English'],
|
|
];
|
|
$current = app()->getLocale();
|
|
$style = $style ?? 'chip';
|
|
$back = urlencode(request()->fullUrl());
|
|
@endphp
|
|
|
|
@if ($style === 'chip')
|
|
<div style="display:inline-flex;align-items:center;gap:2px;background:rgba(255,255,255,.15);border-radius:8px;padding:2px;font-size:12px;">
|
|
@foreach ($locales as $code => $meta)
|
|
<a href="{{ url('/locale/' . $code . '?redirect=' . $back) }}" title="{{ $meta['full'] }}"
|
|
style="background:{{ $code === $current ? 'rgba(255,255,255,.95)' : 'transparent' }};
|
|
color:{{ $code === $current ? '#1f2937' : '#fff' }};
|
|
padding:5px 10px;border-radius:6px;font-size:12px;font-weight:600;
|
|
text-decoration:none;display:inline-block;">
|
|
{{ $meta['label'] }}
|
|
</a>
|
|
@endforeach
|
|
</div>
|
|
@else
|
|
<div style="display:inline-flex;gap:4px;font-size:12px;">
|
|
@foreach ($locales as $code => $meta)
|
|
<a href="{{ url('/locale/' . $code . '?redirect=' . $back) }}" title="{{ $meta['full'] }}"
|
|
style="background:{{ $code === $current ? '#3b82f6' : 'transparent' }};
|
|
color:{{ $code === $current ? '#fff' : '#4b5563' }};
|
|
border:1px solid {{ $code === $current ? '#3b82f6' : '#d1d5db' }};
|
|
padding:4px 10px;border-radius:6px;font-size:12px;font-weight:600;
|
|
text-decoration:none;display:inline-block;">
|
|
{{ $meta['label'] }}
|
|
</a>
|
|
@endforeach
|
|
</div>
|
|
@endif
|