diff --git a/config/users.php b/config/users.php index 70e266eb280..541aa891378 100644 --- a/config/users.php +++ b/config/users.php @@ -176,11 +176,24 @@ | Users may be required to reauthorize before performing certain | sensitive actions. This is called an elevated session. Here | you may configure the duration of the session in minutes. + | You may also disable the elevated session entirely. | */ 'elevated_session_duration' => 15, + /* + |-------------------------------------------------------------------------- + | Elevated Session Disabled + |-------------------------------------------------------------------------- + | + | Here you may enable or disable elevated sessions. Disabling + | can be useful when using OAuth. + | + */ + + 'elevated_sessions_enabled' => true, + /* |-------------------------------------------------------------------------- | Two-Factor Authentication diff --git a/src/Http/Controllers/CP/CpController.php b/src/Http/Controllers/CP/CpController.php index b7a65ed5f88..322088251d9 100644 --- a/src/Http/Controllers/CP/CpController.php +++ b/src/Http/Controllers/CP/CpController.php @@ -72,7 +72,7 @@ public function authorizeProIf($condition) public function requireElevatedSession(): void { - if (! request()->hasElevatedSession()) { + if (config('statamic.users.elevated_sessions_enabled') && ! request()->hasElevatedSession()) { throw new ElevatedSessionAuthorizationException; } } diff --git a/src/Http/Middleware/CP/RequireElevatedSession.php b/src/Http/Middleware/CP/RequireElevatedSession.php index cf493393a8a..5229f528e49 100644 --- a/src/Http/Middleware/CP/RequireElevatedSession.php +++ b/src/Http/Middleware/CP/RequireElevatedSession.php @@ -9,7 +9,7 @@ class RequireElevatedSession { public function handle($request, Closure $next) { - if (! $request->hasElevatedSession()) { + if (config('statamic.users.elevated_sessions_enabled') && ! $request->hasElevatedSession()) { throw new ElevatedSessionAuthorizationException; } diff --git a/tests/Auth/ElevatedSessionTest.php b/tests/Auth/ElevatedSessionTest.php index b90cd98dd92..8b43f883d58 100644 --- a/tests/Auth/ElevatedSessionTest.php +++ b/tests/Auth/ElevatedSessionTest.php @@ -300,6 +300,47 @@ public function middleware_denies_request_when_elevated_session_has_expired_via_ ->assertJson(['message' => __('Requires an elevated session.')]); } + #[Test] + public function middleware_does_not_require_elevated_session_when_elevated_session_is_disabled() + { + config(['statamic.users.elevated_sessions_enabled' => false]); + + $this->actingAs($this->user); + + $this + ->get('/requires-elevated-session') + ->assertOk() + ->assertSee('ok'); + } + + #[Test] + public function middleware_does_not_require_elevated_session_when_elevated_session_is_disabled_even_if_session_expired() + { + config(['statamic.users.elevated_sessions_enabled' => false]); + + $this->actingAs($this->user); + + $this + ->withElevatedSession(now()->subMinutes(16)) + ->get('/requires-elevated-session') + ->assertOk() + ->assertSee('ok'); + } + + #[Test] + public function middleware_does_not_require_elevated_session_when_elevated_session_is_disabled_via_json() + { + config(['statamic.users.elevated_sessions_enabled' => false]); + + $this->actingAs($this->user); + + $this + ->withElevatedSession(now()->subMinutes(16)) + ->getJson('/requires-elevated-session') + ->assertOk() + ->assertSee('ok'); + } + #[Test] public function the_session_is_elevated_upon_login() { diff --git a/tests/Feature/Roles/StoreRoleTest.php b/tests/Feature/Roles/StoreRoleTest.php index 999431e2b95..396afd96ebd 100644 --- a/tests/Feature/Roles/StoreRoleTest.php +++ b/tests/Feature/Roles/StoreRoleTest.php @@ -68,6 +68,26 @@ public function it_denies_access_without_active_elevated_session() ->assertRedirect('/cp/auth/confirm-password'); } + #[Test] + public function it_allows_storing_a_role_without_elevated_session_when_elevated_sessions_are_disabled() + { + config(['statamic.users.elevated_sessions_enabled' => false]); + + $this + ->actingAsUserWithPermissions(['edit roles']) + ->store([ + 'title' => 'No Elevated Session', + 'handle' => 'no_elevated_session', + 'permissions' => ['one', 'two'], + ]) + ->assertOk() + ->assertJson(['redirect' => cp_route('roles.index')]); + + $role = Role::find('no_elevated_session'); + $this->assertEquals('No Elevated Session', $role->title()); + $this->assertEquals(['one', 'two'], $role->permissions()->all()); + } + #[Test] public function it_stores_a_role() {