From 230c9da1df3909350778cf78edc5728e95869c20 Mon Sep 17 00:00:00 2001
From: snipe <snipe@snipe.net>
Date: Wed, 13 Feb 2019 21:30:15 -0800
Subject: [PATCH] Fixed #6703 - fixes password confirmation

---
 app/Http/Controllers/ProfileController.php        | 3 +--
 app/Http/Requests/SaveUserRequest.php             | 6 +++---
 app/Http/Requests/SetupUserRequest.php            | 3 +--
 resources/lang/en/validation.php                  | 1 +
 resources/views/account/change-password.blade.php | 6 +++---
 resources/views/modals/user.blade.php             | 6 +++---
 resources/views/setup/user.blade.php              | 2 +-
 resources/views/users/edit.blade.php              | 8 ++++----
 tests/acceptance/UsersCept.php                    | 4 ++--
 tests/functional/UsersCest.php                    | 2 +-
 10 files changed, 20 insertions(+), 21 deletions(-)

diff --git a/app/Http/Controllers/ProfileController.php b/app/Http/Controllers/ProfileController.php
index 492b65db0b..daa10aa974 100755
--- a/app/Http/Controllers/ProfileController.php
+++ b/app/Http/Controllers/ProfileController.php
@@ -125,8 +125,7 @@ class ProfileController extends Controller
 
         $rules = array(
             'current_password'     => 'required',
-            'password'         => Setting::passwordComplexityRulesSaving('store'),
-            'password_confirm' => 'required|same:password',
+            'password'         => Setting::passwordComplexityRulesSaving('store').'|confirmed',
         );
 
         $validator = \Validator::make($request->all(), $rules);
diff --git a/app/Http/Requests/SaveUserRequest.php b/app/Http/Requests/SaveUserRequest.php
index b721ed0e9e..c577b53ce2 100644
--- a/app/Http/Requests/SaveUserRequest.php
+++ b/app/Http/Requests/SaveUserRequest.php
@@ -37,7 +37,7 @@ class SaveUserRequest extends Request
                 $rules['username'] = 'required_unless:ldap_import,1|string|min:1';
                 if ($this->request->get('ldap_import') == false)
                 {
-                    $rules['password'] = Setting::passwordComplexityRulesSaving('store');
+                    $rules['password'] = Setting::passwordComplexityRulesSaving('store').'|confirmed';
                 }
                 break;
             }
@@ -46,7 +46,7 @@ class SaveUserRequest extends Request
             case 'PUT':
                 $rules['first_name'] = 'required|string|min:1';
                 $rules['username'] = 'required_unless:ldap_import,1|string|min:1';
-                $rules['password'] = Setting::passwordComplexityRulesSaving('update');
+                $rules['password'] = Setting::passwordComplexityRulesSaving('update').'|confirmed';
                 break;
 
             // Save only what's passed
@@ -59,7 +59,7 @@ class SaveUserRequest extends Request
             default:break;
         }
 
-        $rules['password_confirm'] = 'sometimes|required_with:password';
+        \Log::debug($rules);
 
         return $rules;
 
diff --git a/app/Http/Requests/SetupUserRequest.php b/app/Http/Requests/SetupUserRequest.php
index a3a6631909..a58595f757 100644
--- a/app/Http/Requests/SetupUserRequest.php
+++ b/app/Http/Requests/SetupUserRequest.php
@@ -29,8 +29,7 @@ class SetupUserRequest extends Request
           'last_name' => 'required|string|min:1',
           'username' => 'required|string|min:2|unique:users,username,NULL,deleted_at',
           'email' => 'email|unique:users,email',
-          'password' => 'required|min:6',
-          'password_confirm' => 'required|min:6|same:password',
+          'password' => 'required|min:6|confirmed',
           'email_domain' => 'required|min:4',
         ];
     }
diff --git a/resources/lang/en/validation.php b/resources/lang/en/validation.php
index 23116776e3..5c07347013 100644
--- a/resources/lang/en/validation.php
+++ b/resources/lang/en/validation.php
@@ -42,6 +42,7 @@ return array(
     'exists'               => 'The selected :attribute is invalid.',
     'file'                 => 'The :attribute must be a file.',
     'filled'               => 'The :attribute field must have a value.',
+    'hashed_pass'          => 'Your password is incorrect.',
     'image'                => 'The :attribute must be an image.',
     'in'                   => 'The selected :attribute is invalid.',
     'in_array'             => 'The :attribute field does not exist in :other.',
diff --git a/resources/views/account/change-password.blade.php b/resources/views/account/change-password.blade.php
index e612769eb2..4dbc3bb485 100755
--- a/resources/views/account/change-password.blade.php
+++ b/resources/views/account/change-password.blade.php
@@ -37,11 +37,11 @@
     </div>
 
 
-    <div class="form-group {{ $errors->has('password_confirm') ? ' has-error' : '' }}">
+    <div class="form-group {{ $errors->has('password_confirmation') ? ' has-error' : '' }}">
         <label for="password_confirm" class="col-md-3 control-label">New Password</label>
         <div class="col-md-5 required">
-            <input class="form-control" type="password" name="password_confirm" id="password_confirm"  {{ (config('app.lock_passwords') ? ' disabled' : '') }}>
-            {!! $errors->first('password_confirm', '<span class="alert-msg"><i class="fa fa-times"></i> :message</span>') !!}
+            <input class="form-control" type="password" name="password_confirmation" id="password_confirmation"  {{ (config('app.lock_passwords') ? ' disabled' : '') }}>
+            {!! $errors->first('password_confirmation', '<span class="alert-msg"><i class="fa fa-times"></i> :message</span>') !!}
             @if (config('app.lock_passwords'))
             	<p class="help-block">{{ trans('admin/users/table.lock_passwords') }}</p>
             @endif
diff --git a/resources/views/modals/user.blade.php b/resources/views/modals/user.blade.php
index 7aec3ee9de..151254fc5c 100644
--- a/resources/views/modals/user.blade.php
+++ b/resources/views/modals/user.blade.php
@@ -14,7 +14,7 @@
             'numbers': true,
             'specialChars': true,
             'onPasswordGenerated': function (generatedPassword) {
-                $('#modal-password_confirm').val($('#modal-password').val());
+                $('#modal-password_confirmation').val($('#modal-password').val());
             }
         });
     });
@@ -52,8 +52,8 @@
                     </div>
 
                     <div class="dynamic-form-row">
-                        <div class="col-md-4 col-xs-12"><label for="modal-password_confirm">{{ trans('admin/users/table.password_confirm') }}:</label></div>
-                        <div class="col-md-8 col-xs-12 required"><input type='password' name="password_confirm" id='modal-password_confirm' class="form-control">
+                        <div class="col-md-4 col-xs-12"><label for="modal-password_confirmation">{{ trans('admin/users/table.password_confirm') }}:</label></div>
+                        <div class="col-md-8 col-xs-12 required"><input type='password' name="password_confirmation" id='modal-password_confirmation' class="form-control">
                             <div id="generated-password"></div>
                         </div>
                     </div>
diff --git a/resources/views/setup/user.blade.php b/resources/views/setup/user.blade.php
index ad6ed17593..6459a4a3b4 100644
--- a/resources/views/setup/user.blade.php
+++ b/resources/views/setup/user.blade.php
@@ -150,7 +150,7 @@ Create a User ::
       <!-- password confirm -->
       <div class="form-group col-lg-6{{  (\App\Helpers\Helper::checkIfRequired(\App\Models\User::class, 'password')) ? ' required' : '' }} {{ $errors->has('password_confirm') ? 'error' : '' }}">
         {{ Form::label('password_confirmation', trans('admin/users/table.password_confirm')) }}
-        {{ Form::password('password_confirm', array('class' => 'form-control')) }}
+        {{ Form::password('password_confirmation', array('class' => 'form-control')) }}
         {!! $errors->first('password_confirmation', '<span class="alert-msg">:message</span>') !!}
       </div>
     </div>
diff --git a/resources/views/users/edit.blade.php b/resources/views/users/edit.blade.php
index 4f8247af1e..172448be09 100755
--- a/resources/views/users/edit.blade.php
+++ b/resources/views/users/edit.blade.php
@@ -163,14 +163,14 @@
 
                 @if ($user->ldap_import!='1')
                 <!-- Password Confirm -->
-                <div class="form-group {{ $errors->has('password_confirm') ? 'has-error' : '' }}">
-                  <label class="col-md-3 control-label" for="password_confirm">
+                <div class="form-group {{ $errors->has('password_confirmation') ? 'has-error' : '' }}">
+                  <label class="col-md-3 control-label" for="password_confirmation">
                     {{ trans('admin/users/table.password_confirm') }}
                   </label>
                   <div class="col-md-5 {{  ((\App\Helpers\Helper::checkIfRequired($user, 'first_name')) && (!$user->id)) ? ' required' : '' }}">
                     <input
                     type="password"
-                    name="password_confirm"
+                    name="password_confirmation"
                     id="password_confirm"
                     class="form-control"
                     value=""
@@ -182,7 +182,7 @@
                     @if (config('app.lock_passwords') && ($user->id))
                     <p class="help-block">{{ trans('admin/users/table.lock_passwords') }}</p>
                     @endif
-                    {!! $errors->first('password_confirm', '<span class="alert-msg">:message</span>') !!}
+                    {!! $errors->first('password_confirmation', '<span class="alert-msg">:message</span>') !!}
                   </div>
                 </div>
                 @endif
diff --git a/tests/acceptance/UsersCept.php b/tests/acceptance/UsersCept.php
index a4f46a92d6..85d695b3eb 100644
--- a/tests/acceptance/UsersCept.php
+++ b/tests/acceptance/UsersCept.php
@@ -59,8 +59,8 @@ $I->click(['name' => 'username']);
 $I->fillField(['name' => 'username'], \App\Helpers\Helper::generateRandomString(15));
 $I->click(['name' => 'password']);
 $I->fillField(['name' => 'password'], 'password');
-$I->click(['name' => 'password_confirm']);
-$I->fillField(['name' => 'password_confirm'], 'password');
+$I->click(['name' => 'password_confirmation']);
+$I->fillField(['name' => 'password_confirmation'], 'password');
 $I->click('Save');
 $I->seeElement('.alert-success');
 $I->dontSeeInSource('&lt;br&gt;&lt;');
diff --git a/tests/functional/UsersCest.php b/tests/functional/UsersCest.php
index c3e017cbe4..98722430b3 100644
--- a/tests/functional/UsersCest.php
+++ b/tests/functional/UsersCest.php
@@ -54,7 +54,7 @@ class UsersCest
             'last_name'         => $user->last_name,
             'username'          => $user->username,
             'password'          => $user->password,
-            'password_confirm'  => $user->password,
+            'password_confirmation'  => $user->password,
             'email'             => $user->email,
             'company_id'        => $user->company_id,
             'locale'            => $user->locale,