From 6875b0dd2238a3baca4995313d34071c50792b36 Mon Sep 17 00:00:00 2001
From: Andy Heathershaw <andy@andys.eu>
Date: Mon, 5 Sep 2016 21:43:58 +0100
Subject: [PATCH] Added security configuration items for registration options

---
 app/Helpers/ConfigHelper.php                  |  4 +++-
 .../Controllers/Admin/DefaultController.php   | 11 +++++++++
 .../Controllers/Auth/RegisterController.php   | 18 ++++++++++++++-
 .../themes/base/admin/settings.blade.php      | 23 +++++++++++++++++--
 .../themes/base/partials/navbar.blade.php     |  5 +++-
 5 files changed, 56 insertions(+), 5 deletions(-)

diff --git a/app/Helpers/ConfigHelper.php b/app/Helpers/ConfigHelper.php
index 9c0d7bd..8133ed7 100644
--- a/app/Helpers/ConfigHelper.php
+++ b/app/Helpers/ConfigHelper.php
@@ -52,8 +52,10 @@ class ConfigHelper
     public function defaults()
     {
         return array(
+            'allow_self_registration' => true,
             'app_name' => trans('global.app_name'),
-            'date_format' => $this->allowedDateFormats()[0]
+            'date_format' => $this->allowedDateFormats()[0],
+            'require_email_verification' => true
         );
     }
 
diff --git a/app/Http/Controllers/Admin/DefaultController.php b/app/Http/Controllers/Admin/DefaultController.php
index f0bbe86..46ec2cb 100644
--- a/app/Http/Controllers/Admin/DefaultController.php
+++ b/app/Http/Controllers/Admin/DefaultController.php
@@ -30,6 +30,10 @@ class DefaultController extends Controller
 
     public function saveSettings(SaveSettingsRequest $request)
     {
+        $checkboxKeys = [
+            'allow_self_registration',
+            'require_email_verification'
+        ];
         $updateKeys = [
             'app_name',
             'date_format',
@@ -43,6 +47,13 @@ class DefaultController extends Controller
             $config->save();
         }
 
+        foreach ($checkboxKeys as $key)
+        {
+            $config = UserConfig::getOrCreateModel($key);
+            $config->value = ($request->request->get($key) == 'on' ? 1 : 0);
+            $config->save();
+        }
+
         $request->session()->flash('success', trans('admin.settings_saved_message'));
         return redirect(route('admin.settings'));
     }
diff --git a/app/Http/Controllers/Auth/RegisterController.php b/app/Http/Controllers/Auth/RegisterController.php
index add3da4..6d87798 100644
--- a/app/Http/Controllers/Auth/RegisterController.php
+++ b/app/Http/Controllers/Auth/RegisterController.php
@@ -3,6 +3,7 @@
 namespace App\Http\Controllers\Auth;
 
 use App\Facade\Theme;
+use App\Facade\UserConfig;
 use App\User;
 use Validator;
 use App\Http\Controllers\Controller;
@@ -70,6 +71,16 @@ class RegisterController extends Controller
         ]);
     }
 
+    public function register(Request $request)
+    {
+        if (UserConfig::get('allow_self_registration') == 1)
+        {
+            return parent::register($request);
+        }
+
+        return redirect(route('home'));
+    }
+
     /**
      * Show the application registration form.
      *
@@ -77,6 +88,11 @@ class RegisterController extends Controller
      */
     public function showRegistrationForm()
     {
-        return Theme::render('auth.register');
+        if (UserConfig::get('allow_self_registration') == 1)
+        {
+            return Theme::render('auth.register');
+        }
+
+        return redirect(route('home'));
     }
 }
diff --git a/resources/views/themes/base/admin/settings.blade.php b/resources/views/themes/base/admin/settings.blade.php
index 590450b..8625844 100644
--- a/resources/views/themes/base/admin/settings.blade.php
+++ b/resources/views/themes/base/admin/settings.blade.php
@@ -13,12 +13,13 @@
                     <div>
                         {{-- Nav tabs --}}
                         <ul class="nav nav-tabs" role="tablist">
-                            <li role="presentation" class="active"><a href="#upload-tab" aria-controls="upload-tab" role="tab" data-toggle="tab"><i class="fa fa-fw fa-info-circle"></i> General</a></li>
+                            <li role="presentation" class="active"><a href="#general-tab" aria-controls="general-tab" role="tab" data-toggle="tab"><i class="fa fa-fw fa-info-circle"></i> General</a></li>
+                            <li role="presentation"><a href="#security-tab" aria-controls="security-tab" role="tab" data-toggle="tab"><i class="fa fa-fw fa-lock"></i> Security</a></li>
                         </ul>
 
                         {{-- Tab panes --}}
                         <div class="tab-content">
-                            <div role="tabpanel" class="tab-pane active" id="upload-tab">
+                            <div role="tabpanel" class="tab-pane active" id="general-tab">
                                 <div class="form-group">
                                     {!! Form::label('app_name', 'Gallery name:', ['class' => 'control-label']) !!}
                                     {!! Form::text('app_name', old('app_name'), ['class' => 'form-control']) !!}
@@ -42,6 +43,24 @@
                                     </div>
                                 </div>
                             </div>
+
+                            <div role="tabpanel" class="tab-pane" id="security-tab">
+                                <div class="checkbox">
+                                    <label>
+                                        <input type="checkbox" name="allow_self_registration" @if (UserConfig::get('allow_self_registration') == 1)checked="checked"@endif>
+                                        <strong>Allow self-registration</strong><br/>
+                                        With this option enabled, users can sign up for their own &quot;visitor&quot; accounts to comment on photos.
+                                    </label>
+                                </div>
+
+                                <div class="checkbox" style="margin-top: 20px;">
+                                    <label>
+                                        <input type="checkbox" name="require_email_verification" @if (UserConfig::get('require_email_verification') == 1)checked="checked"@endif>
+                                        <strong>Require e-mail verification for self-registered accounts</strong><br/>
+                                        <span class="text-danger">It is strongly recommended to enable this option.</span>
+                                    </label>
+                                </div>
+                            </div>
                         </div>
                     </div>
 
diff --git a/resources/views/themes/base/partials/navbar.blade.php b/resources/views/themes/base/partials/navbar.blade.php
index e9347f8..d7fdc27 100644
--- a/resources/views/themes/base/partials/navbar.blade.php
+++ b/resources/views/themes/base/partials/navbar.blade.php
@@ -39,7 +39,10 @@
                 {{--  Authentication Links --}}
                 @if (Auth::guest())
                     <li><a href="{{ url('/login') }}">Login</a></li>
-                    <li><a href="{{ url('/register') }}">Register</a></li>
+
+                    @if (UserConfig::get('allow_self_registration') == 1)
+                        <li><a href="{{ url('/register') }}">Register</a></li>
+                    @endif
                 @else
                     <li class="dropdown">
                         <a href="#" class="dropdown-toggle" data-toggle="dropdown" role="button" aria-expanded="false" style="padding-top: 4px; padding-bottom: 4px;">