Fix changing a user password to not incorrectly handle logging out old sessions; closes pterodactyl#3531

Author: DaneEveritt

app/Http/Controllers/Api/Client/AccountController.php

@@ -58,12 +58,17 @@ public function updateEmail(UpdateEmailRequest $request): JsonResponse
      * Update the authenticated user's password. All existing sessions will be logged
      * out immediately.
      *
-     * @throws \Pterodactyl\Exceptions\Model\DataValidationException
-     * @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
+     * @throws \Throwable
      */
     public function updatePassword(UpdatePasswordRequest $request): JsonResponse
     {
-        $this->updateService->handle($request->user(), $request->validated());
+        $user = $this->updateService->handle($request->user(), $request->validated());
+
+        // If you do not update the user in the session you'll end up working with a
+        // cached copy of the user that does not include the updated password. Do this
+        // to correctly store the new user details in the guard and allow the logout
+        // other devices functionality to work.
+        $this->sessionGuard->setUser($user);
 
         $this->sessionGuard->logoutOtherDevices($request->input('password'));
 

app/Http/Requests/Api/Client/Account/UpdateEmailRequest.php

@@ -3,6 +3,8 @@
 namespace Pterodactyl\Http\Requests\Api\Client\Account;
 
 use Pterodactyl\Models\User;
+use Illuminate\Container\Container;
+use Illuminate\Contracts\Hashing\Hasher;
 use Pterodactyl\Http\Requests\Api\Client\ClientApiRequest;
 use Pterodactyl\Exceptions\Http\Base\InvalidPasswordProvidedException;
 
@@ -17,8 +19,10 @@ public function authorize(): bool
             return false;
         }
 
+        $hasher = Container::getInstance()->make(Hasher::class);
+
         // Verify password matches when changing password or email.
-        if (!password_verify($this->input('password'), $this->user()->password)) {
+        if (!$hasher->check($this->input('password'), $this->user()->password)) {
             throw new InvalidPasswordProvidedException(trans('validation.internal.invalid_password'));
         }
 

app/Http/Requests/Api/Client/Account/UpdatePasswordRequest.php

@@ -2,6 +2,8 @@
 
 namespace Pterodactyl\Http\Requests\Api\Client\Account;
 
+use Illuminate\Container\Container;
+use Illuminate\Contracts\Hashing\Hasher;
 use Pterodactyl\Http\Requests\Api\Client\ClientApiRequest;
 use Pterodactyl\Exceptions\Http\Base\InvalidPasswordProvidedException;
 
@@ -16,8 +18,10 @@ public function authorize(): bool
             return false;
         }
 
+        $hasher = Container::getInstance()->make(Hasher::class);
+
         // Verify password matches when changing password or email.
-        if (!password_verify($this->input('current_password'), $this->user()->password)) {
+        if (!$hasher->check($this->input('current_password'), $this->user()->password)) {
             throw new InvalidPasswordProvidedException(trans('validation.internal.invalid_password'));
         }
 

app/Services/Users/UserUpdateService.php

@@ -5,7 +5,6 @@
 use Pterodactyl\Models\User;
 use Illuminate\Contracts\Hashing\Hasher;
 use Pterodactyl\Traits\Services\HasUserLevels;
-use Pterodactyl\Repositories\Eloquent\UserRepository;
 
 class UserUpdateService
 {
@@ -16,39 +15,29 @@ class UserUpdateService
      */
     private $hasher;
 
-    /**
-     * @var \Pterodactyl\Repositories\Eloquent\UserRepository
-     */
-    private $repository;
-
     /**
      * UpdateService constructor.
      */
-    public function __construct(Hasher $hasher, UserRepository $repository)
+    public function __construct(Hasher $hasher)
     {
         $this->hasher = $hasher;
-        $this->repository = $repository;
     }
 
     /**
-     * Update the user model instance.
-     *
-     * @return \Pterodactyl\Models\User
+     * Update the user model instance and return the updated model.
      *
-     * @throws \Pterodactyl\Exceptions\Model\DataValidationException
-     * @throws \Pterodactyl\Exceptions\Repository\RecordNotFoundException
+     * @throws \Throwable
      */
-    public function handle(User $user, array $data)
+    public function handle(User $user, array $data): User
     {
         if (!empty(array_get($data, 'password'))) {
             $data['password'] = $this->hasher->make($data['password']);
         } else {
             unset($data['password']);
         }
 
-        /** @var \Pterodactyl\Models\User $response */
-        $response = $this->repository->update($user->id, $data);
+        $user->forceFill($data)->saveOrFail();
 
-        return $response;
+        return $user->refresh();
     }
 }

tests/Integration/Api/Client/AccountControllerTest.php

@@ -2,10 +2,9 @@
 
 namespace Pterodactyl\Tests\Integration\Api\Client;
 
-use Mockery;
 use Pterodactyl\Models\User;
 use Illuminate\Http\Response;
-use Illuminate\Auth\AuthManager;
+use Illuminate\Support\Facades\Hash;
 
 class AccountControllerTest extends ClientApiIntegrationTestCase
 {
@@ -106,17 +105,20 @@ public function testPasswordIsUpdated()
         /** @var \Pterodactyl\Models\User $user */
         $user = User::factory()->create();
 
-        $mock = Mockery::mock(AuthManager::class);
-        $mock->expects('logoutOtherDevices')->with('New_Password1');
-
-        $this->app->instance(AuthManager::class, $mock);
+        $initialHash = $user->password;
 
         $response = $this->actingAs($user)->putJson('/api/client/account/password', [
             'current_password' => 'password',
             'password' => 'New_Password1',
             'password_confirmation' => 'New_Password1',
         ]);
 
+        $user = $user->refresh();
+
+        $this->assertNotEquals($user->password, $initialHash);
+        $this->assertTrue(Hash::check('New_Password1', $user->password));
+        $this->assertFalse(Hash::check('password', $user->password));
+
         $response->assertStatus(Response::HTTP_NO_CONTENT);
     }