Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
86 changes: 84 additions & 2 deletions app/Http/Controllers/Auth/LoginController.php
Original file line number Diff line number Diff line change
Expand Up @@ -31,14 +31,15 @@

namespace App\Http\Controllers\Auth;

use App\Http\Controllers\Controller;
use App\Models\User;
use App\Notifications\SendToken2FA;
use App\Providers\RouteServiceProvider;
use App\Http\Controllers\Controller;
use Illuminate\Foundation\Auth\AuthenticatesUsers;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Facades\View;
use App\Services\ActivityLogger;

class LoginController extends Controller
{
Expand All @@ -53,7 +54,9 @@ class LoginController extends Controller
|
*/

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[HIGH] 🐛 Bug: Auth::user() Null Dereference - Fatal Error Setelah Login

Kode:

$user = Auth::user();
// ...
ActivityLogger::log('login', "Pengguna {$user->name} berhasil login", $user, 'success');

Skenario: Race condition dimana user berhasil authenticate tapi kemudian dihapus/disabled sebelum Auth::user() dipanggil. $user akan null, akses $user->name menyebabkan fatal error "Trying to get property 'name' of null".

Dampak:

  • User berhasil login tapi dapat white screen/500 error
  • Session sudah dibuat tapi user tidak bisa masuk
  • Harus logout manual atau clear session

Fix:

protected function authenticated(Request $request, $user)
{
    if (!$user) {
        Auth::logout();
        return redirect()->route('login')->with('error', 'Terjadi kesalahan saat login');
    }
    
    try {
        ActivityLogger::log('login', "Pengguna {$user->name} berhasil login", $user, 'success');
    } catch (\Exception $e) {
        report($e);
        // Jangan crash login flow jika logging gagal
    }
    
    return redirect()->intended($this->redirectPath());
}

use AuthenticatesUsers;
use AuthenticatesUsers {
sendFailedLoginResponse as traitSendFailedLoginResponse;
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[HIGH] 🐛 Bug: ActivityLogger Exception Menghentikan Login Flow

Kode: ActivityLogger::log('login', "Pengguna {$user->name} berhasil login", $user, 'success');

Skenario: ActivityLogger::log() throw exception (dari IpLocationResolver network error atau cache error). Exception tidak di-catch, user sudah authenticated tapi melihat error page.

Dampak:

  • Login berhasil (session dibuat) tapi user lihat error 500
  • User bingung apakah login berhasil atau tidak
  • Harus refresh page untuk masuk

Fix:

protected function authenticated(Request $request, $user)
{
    try {
        ActivityLogger::log('login', "Pengguna {$user->name} berhasil login", $user, 'success');
    } catch (\Exception $e) {
        report($e);
        // Jangan crash login flow
    }
    
    return redirect()->intended($this->redirectPath());
}

}

/**
* Where to redirect users after login.
Expand Down Expand Up @@ -134,13 +137,92 @@ protected function validateLogin(Request $request)
}
protected function authenticated(Request $request, $user)
{
// Log successful login
ActivityLogger::log(
category: 'login',
event: 'success',
message: 'Pengguna berhasil masuk ke sistem',
subject: $user,
causer: $user,
additionalProperties: [
'user_id' => $user->id,
'email' => $user->email,
'status' => 'authenticated',
]
);

if (($this->settings['login_2fa'] ?? false)) {
return $this->startTwoFactorAuthProcess($request, $user);
}

return redirect()->intended($this->redirectPath());
}

/**
* Handle a failed authentication attempt.
*
* @param \Illuminate\Http\Request $request
* @return void
*
* @throws \Illuminate\Validation\ValidationException
*/
protected function sendFailedLoginResponse(Request $request)
{
// Log failed login attempt
ActivityLogger::log(
category: 'login',
event: 'failed',
message: 'Percobaan login gagal',
subject: null,
causer: null,
additionalProperties: [
'email' => $request->input($this->username()),
'status' => 'invalid_credentials',
]
);

return $this->traitSendFailedLoginResponse($request);
}

/**
* The user has logged out of the application.
*
* @param \Illuminate\Http\Request $request
* @return mixed
*/
public function logout(Request $request)
{
// Log the logout event before logging out
if (auth()->check()) {
ActivityLogger::log(
category: 'login',
event: 'logout',
message: 'Pengguna keluar dari sistem',
subject: auth()->user(),
causer: auth()->user(),
additionalProperties: [
'user_id' => auth()->id(),
'email' => auth()->user()->email ?? null,
'status' => 'logged_out',
]
);
}

$this->guard()->logout();

$request->session()->invalidate();

$request->session()->regenerateToken();

return $this->loggedOut($request) ?: redirect('/');
}

protected function loggedOut(Request $request)
{
// This method can be used for additional logic after logout
// For example, flashing a session message.
}

/**
* Log out the user and start the two factor authentication state.
*
Expand Down
24 changes: 24 additions & 0 deletions app/Http/Controllers/Data/ProfilController.php
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@
use App\Models\Profil;
use Illuminate\Http\Response;
use Illuminate\Support\Facades\Cache;
use App\Services\ActivityLogger;

class ProfilController extends Controller
{
Expand Down Expand Up @@ -110,11 +111,34 @@ public function update(ProfilRequest $request, $id)
$profil->update();
$dataumum->update();

ActivityLogger::log(
category: 'profil',
event: 'updated',
message: "Mengubah data profil kecamatan: {$profil->nama_kecamatan}",
subject: $profil,
causer: auth()->user(),
additionalProperties: [
'profil_id' => $profil->id,
'changes' => array_merge($profil->getChanges(), $dataumum?->getChanges() ?? []),
]
);

// Clear cache setelah update data kecamatan
$this->clearProfilCache();
} catch (\Exception $e) {
report($e);

ActivityLogger::log(
category: 'profil',
event: 'failed',
message: 'Gagal mengubah profil kecamatan',
causer: auth()->user(),
additionalProperties: [
'error' => $e->getMessage(),
'profil_id' => $id,
]
);

return back()->withInput()->with('error', 'Update Profil gagal!');
}

Expand Down
Loading