From d732e754eb2e9b06a2375e76c8331ce43e0a3a21 Mon Sep 17 00:00:00 2001
From: DariusIII <dkrisan@gmail.com>
Date: Fri, 16 Jan 2026 21:20:32 +0100
Subject: [PATCH] Fix access to 2fa for unauthenticated users

---
 .../PasswordSecurityController.php            | 65 +++++++++++++++++--
 1 file changed, 58 insertions(+), 7 deletions(-)

diff --git a/app/Http/Controllers/PasswordSecurityController.php b/app/Http/Controllers/PasswordSecurityController.php
index fb58c5968..377ed3658 100644
--- a/app/Http/Controllers/PasswordSecurityController.php
+++ b/app/Http/Controllers/PasswordSecurityController.php
@@ -14,10 +14,16 @@ use Illuminate\Support\Facades\Hash;
 
 class PasswordSecurityController extends Controller
 {
-    public function show2faForm(Request $request): Application|View|Factory|\Illuminate\Contracts\Foundation\Application
+    public function show2faForm(Request $request): Application|View|Factory|\Illuminate\Contracts\Foundation\Application|RedirectResponse
     {
         $user = $request->user();
 
+        if (! $user) {
+            return redirect()->route('login')
+                ->with('message', 'Please log in to access 2FA settings.')
+                ->with('message_type', 'danger');
+        }
+
         $google2fa_url = '';
         if ($user->passwordSecurity()->exists()) {
             $google2fa_url = \Google2FA::getQRCodeInline(
@@ -43,6 +49,12 @@ class PasswordSecurityController extends Controller
     {
         $user = $request->user();
 
+        if (! $user) {
+            return redirect()->route('login')
+                ->with('message', 'Please log in to access 2FA settings.')
+                ->with('message_type', 'danger');
+        }
+
         // Add the secret key to the registration data
         PasswordSecurity::create(
             [
@@ -68,6 +80,13 @@ class PasswordSecurityController extends Controller
     public function enable2fa(Request $request): RedirectResponse
     {
         $user = $request->user();
+
+        if (! $user) {
+            return redirect()->route('login')
+                ->with('message', 'Please log in to access 2FA settings.')
+                ->with('message_type', 'danger');
+        }
+
         $secret = $request->input('verify-code');
         $valid = \Google2FA::verifyKey($user->passwordSecurity->google2fa_secret, $secret);
         if ($valid) {
@@ -86,6 +105,12 @@ class PasswordSecurityController extends Controller
     {
         $user = $request->user();
 
+        if (! $user) {
+            return redirect()->route('login')
+                ->with('message', 'Please log in to access 2FA settings.')
+                ->with('message_type', 'danger');
+        }
+
         // Only allow canceling if 2FA is not yet enabled
         if ($user->passwordSecurity()->exists() && ! $user->passwordSecurity->google2fa_enable) {
             $user->passwordSecurity()->delete();
@@ -98,13 +123,20 @@ class PasswordSecurityController extends Controller
 
     public function disable2fa(Disable2faPasswordSecurityRequest $request): \Illuminate\Routing\Redirector|RedirectResponse|\Illuminate\Contracts\Foundation\Application
     {
-        if (! (Hash::check($request->get('current-password'), $request->user()->password))) {
+        $user = $request->user();
+
+        if (! $user) {
+            return redirect()->route('login')
+                ->with('message', 'Please log in to access 2FA settings.')
+                ->with('message_type', 'danger');
+        }
+
+        if (! (Hash::check($request->get('current-password'), $user->password))) {
             // Password doesn't match - always redirect to profile page with error
             return redirect()->to('profileedit#security')->with('error_2fa', 'Your password does not match with your account password. Please try again.');
         }
 
         $validatedData = $request->validated();
-        $user = $request->user();
 
         // Delete the password security record entirely to fully disable 2FA
         if ($user->passwordSecurity) {
@@ -252,15 +284,22 @@ class PasswordSecurityController extends Controller
      */
     public function profileDisable2fa(Request $request): RedirectResponse
     {
+        $user = $request->user();
+
+        if (! $user) {
+            return redirect()->route('login')
+                ->with('message', 'Please log in to access 2FA settings.')
+                ->with('message_type', 'danger');
+        }
+
         $request->validate([
             'current-password' => 'required',
         ]);
 
-        if (! (Hash::check($request->get('current-password'), $request->user()->password))) {
+        if (! (Hash::check($request->get('current-password'), $user->password))) {
             return redirect()->to('profileedit#security')->with('error_2fa', 'Your password does not match with your account password. Please try again.');
         }
 
-        $user = $request->user();
         if ($user->passwordSecurity) {
             $user->passwordSecurity->google2fa_enable = 0;
             $user->passwordSecurity->save();
@@ -272,10 +311,16 @@ class PasswordSecurityController extends Controller
     /**
      * Show the 2FA enable form on a dedicated page
      */
-    public function showEnable2faForm(Request $request): Application|View|Factory|\Illuminate\Contracts\Foundation\Application
+    public function showEnable2faForm(Request $request): Application|View|Factory|\Illuminate\Contracts\Foundation\Application|RedirectResponse
     {
         $user = $request->user();
 
+        if (! $user) {
+            return redirect()->route('login')
+                ->with('message', 'Please log in to access 2FA settings.')
+                ->with('message_type', 'danger');
+        }
+
         $google2fa_url = '';
         if ($user->passwordSecurity()->exists()) {
             $google2fa_url = \Google2FA::getQRCodeInline(
@@ -296,10 +341,16 @@ class PasswordSecurityController extends Controller
     /**
      * Show the 2FA disable form on a dedicated page
      */
-    public function showDisable2faForm(Request $request): Application|View|Factory|\Illuminate\Contracts\Foundation\Application
+    public function showDisable2faForm(Request $request): Application|View|Factory|\Illuminate\Contracts\Foundation\Application|RedirectResponse
     {
         $user = $request->user();
 
+        if (! $user) {
+            return redirect()->route('login')
+                ->with('message', 'Please log in to access 2FA settings.')
+                ->with('message_type', 'danger');
+        }
+
         $google2fa_url = '';
         if ($user->passwordSecurity()->exists()) {
             $google2fa_url = \Google2FA::getQRCodeInline(