ghassanandClaude Opus 4.7
a1493462f7
Add App\Rules\ReservedIdentifier for name + email local-part so users cannot impersonate staff (admin, superadmin, support, root, takeone, …). Separators are collapsed so "super_admin"/"super-admin"/"superadmin" all match. Rule wired into RegisteredUserController@store. email_verified_at is already absent from User::$fillable so only the signed verification route can flip it — audited, no code change needed. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
57 lines
1.9 KiB
PHP
57 lines
1.9 KiB
PHP
<?php
|
|
|
|
namespace App\Rules;
|
|
|
|
use Closure;
|
|
use Illuminate\Contracts\Validation\ValidationRule;
|
|
|
|
/**
|
|
* Blocks impersonation of staff/system accounts.
|
|
*
|
|
* Applied to both `name` and the email local-part at registration so a user
|
|
* cannot sign up as "admin", "superadmin", "takeone", etc. — words that would
|
|
* let them pass themselves off as the platform or its operators to other
|
|
* users (comments, DMs, channel pages).
|
|
*/
|
|
class ReservedIdentifier implements ValidationRule
|
|
{
|
|
private const RESERVED = [
|
|
'admin', 'administrator', 'superadmin', 'super-admin', 'super_admin',
|
|
'root', 'sysadmin', 'system', 'owner', 'webmaster', 'postmaster',
|
|
'moderator', 'mod', 'staff', 'official',
|
|
'support', 'help', 'helpdesk', 'contact', 'info', 'noreply', 'no-reply',
|
|
'security', 'abuse', 'billing',
|
|
'takeone', 'take-one', 'take_one', 'takeonebh', 'takeone-bh',
|
|
'play', 'playbh', 'playtakeone',
|
|
'anonymous', 'guest', 'null', 'undefined',
|
|
];
|
|
|
|
public function __construct(private readonly string $kind = 'name')
|
|
{
|
|
}
|
|
|
|
public function validate(string $attribute, mixed $value, Closure $fail): void
|
|
{
|
|
if (! is_string($value)) {
|
|
return;
|
|
}
|
|
|
|
$candidate = $this->kind === 'email'
|
|
? strtolower(trim(strstr($value, '@', true) ?: $value))
|
|
: strtolower(trim($value));
|
|
|
|
// Collapse separators so "super_admin", "super-admin" and "superadmin" all match.
|
|
$normalized = preg_replace('/[\s._\-]+/', '', $candidate) ?? $candidate;
|
|
|
|
foreach (self::RESERVED as $word) {
|
|
$target = preg_replace('/[\s._\-]+/', '', $word) ?? $word;
|
|
if ($normalized === $target) {
|
|
$fail($this->kind === 'email'
|
|
? 'That email address is reserved. Please use a different one.'
|
|
: 'That name is reserved. Please choose a different one.');
|
|
return;
|
|
}
|
|
}
|
|
}
|
|
}
|