Vasyka
b9d096fa59
The previous POST-based switcher failed silently: CSRF token check
returned 419 when clicking, and the session never persisted.
Root causes:
- POST requires @csrf token, but the test path fetched pages that had
no matching form so the token in the DOM didn't match the session
- Some tenant subdomains had SESSION_DOMAIN scoped differently, so
the cookie set by POST didn't come back on the follow-up GET
- Prod .env had APP_LOCALE=en which took precedence over the config
edit; when session had no locale yet, defaulted to English
Fixes:
1. Route accepts BOTH GET and POST via Route::match(['get', 'post']).
Setting your own language is not a security concern — GET is fine.
2. Route explicitly calls $request->session()->save() before redirect,
forcing the session store to write before the redirect fires.
Also honors ?redirect=<url> query so the user lands back on their
original page rather than referer-guessing.
3. lang-switcher partial rewrites to plain <a href> tags (no @csrf,
no forms). Each link points at /locale/{code}?redirect={current-url}
so the switch happens in a single hop with predictable target.
4. SetLocale middleware hard-codes 'ro' as the ultimate fallback,
ignoring config/env. The Romanian portal is the default
client-facing surface; if a client has no session locale set and
no user account, they see Romanian (safer than English which has
no portal translations).
Suite: 306 passed (853 assertions). Unchanged.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
52 lines
1.4 KiB
PHP
52 lines
1.4 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use App\Tenancy\TenantManager;
|
|
use Closure;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\App;
|
|
use Illuminate\Support\Facades\Auth;
|
|
use Carbon\Carbon;
|
|
|
|
class SetLocale
|
|
{
|
|
private const SUPPORTED = ['ro', 'ru', 'en'];
|
|
|
|
public function handle(Request $request, Closure $next)
|
|
{
|
|
$locale = $this->resolve($request);
|
|
|
|
App::setLocale($locale);
|
|
Carbon::setLocale($locale);
|
|
|
|
return $next($request);
|
|
}
|
|
|
|
private function resolve(Request $request): string
|
|
{
|
|
// Session may not be started yet on early-stage middleware paths.
|
|
if ($request->hasSession()) {
|
|
$session = $request->session()->get('locale');
|
|
if ($session && in_array($session, self::SUPPORTED, true)) {
|
|
return $session;
|
|
}
|
|
}
|
|
|
|
$user = Auth::user();
|
|
if ($user && ! empty($user->locale) && in_array($user->locale, self::SUPPORTED, true)) {
|
|
return $user->locale;
|
|
}
|
|
|
|
$tenant = app(TenantManager::class)->current();
|
|
$tenantLang = $tenant?->settings['language'] ?? null;
|
|
if ($tenantLang && in_array($tenantLang, self::SUPPORTED, true)) {
|
|
return $tenantLang;
|
|
}
|
|
|
|
// Hard-code fallback la 'ro' — indiferent de APP_LOCALE din env,
|
|
// portal-ul client-facing e livrat cu RO ca implicit safe (RU disponibil via switcher).
|
|
return 'ro';
|
|
}
|
|
}
|