mirror of
https://github.com/projectsend/projectsend.git
synced 2026-09-19 01:55:08 +00:00
Ignacio Nelson
30f08fdd3b
A write that meets an expired session lands on the login page A browser follows a 302 by replaying the request method, POST aside, so a widget save whose session had expired replayed as PUT /login — and /login takes GET and POST only. The 405 that came back hid the one thing the person needed to be told, which was to sign in again. Inertia already upgrades 302 to 303 for writes, but a redirect rendered during exception handling never travels back through the middleware stack, so the guest redirect after AuthenticationException was never reached. bootstrap/app.php now does it for those. Fixes #1673, reported by @mstewart14. Found, diagnosed and fixed by @denkfabrik-li, who also wrote down the part this does not cover: the direct redirects from EnsureSetupIsComplete, EnsureAccountIsActive and EnforceTwoFactor sit outside HandleInertiaRequests and can still produce the same 405 on a write.