{"action":"created","issue":{"url":"https://api.github.com/repos/laravel/framework/issues/14824","repository_url":"https://api.github.com/repos/laravel/framework","labels_url":"https://api.github.com/repos/laravel/framework/issues/14824/labels{/name}","comments_url":"https://api.github.com/repos/laravel/framework/issues/14824/comments","events_url":"https://api.github.com/repos/laravel/framework/issues/14824/events","html_url":"https://github.com/laravel/framework/pull/14824","id":171124345,"number":14824,"title":"[5.3] Using cached controller can lead to race conditions with middleware","user":{"login":"tomschlick","id":70184,"avatar_url":"https://avatars.githubusercontent.com/u/70184?v=3","gravatar_id":"","url":"https://api.github.com/users/tomschlick","html_url":"https://github.com/tomschlick","followers_url":"https://api.github.com/users/tomschlick/followers","following_url":"https://api.github.com/users/tomschlick/following{/other_user}","gists_url":"https://api.github.com/users/tomschlick/gists{/gist_id}","starred_url":"https://api.github.com/users/tomschlick/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tomschlick/subscriptions","organizations_url":"https://api.github.com/users/tomschlick/orgs","repos_url":"https://api.github.com/users/tomschlick/repos","events_url":"https://api.github.com/users/tomschlick/events{/privacy}","received_events_url":"https://api.github.com/users/tomschlick/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-08-15T07:54:34Z","updated_at":"2016-08-15T13:00:20Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/laravel/framework/pulls/14824","html_url":"https://github.com/laravel/framework/pull/14824","diff_url":"https://github.com/laravel/framework/pull/14824.diff","patch_url":"https://github.com/laravel/framework/pull/14824.patch"},"body":"Just ran into an issue with a recent change in 5.3 in which `Illuminate\\Routing\\Route::getController()` now caches it's result.\r\n\r\nBasically if you are running auth middleware via a group parameter in your routes file\r\n```php\r\n\r\n$router->group(['prefix' => 'projects', 'middleware' => ['auth']], function($router) {\r\n    // Controller setups here\r\n});\r\n\r\n```\r\n\r\nand you use the `__construct()` method in your controller to bootstrap things that require auth in your controller\r\n\r\n```php\r\n\r\npublic function __construct()\r\n{\r\n    parent::__construct();\r\n\r\n    // this checks the currently logged in user\r\n    $this->participant = $this->project->currentParticipant();\r\n}\r\n```\r\n\r\nWhat you will see is that the Routing class will call `gatherMiddleware()` which will in turn call `controllerMiddleware()`. That `controllerMiddleware()` inits the controller class (to do reflection for any other middleware calls) before any route specified middleware is fired (the auth in this case) and caches the result.\r\n\r\nSo when the example above happens, `$this->participant` is `null` because the auth middleware hasn't fired yet, logging the user in for that request.\r\n\r\nBy removing the cache of `$this->controller` it allows the controller to be re-built after all the middleware is initiated and clears this bug up.\r\n\r\nIt looks like the bug was unintentionally introduced in #14097 by @JosephSilber ... Joseph can you take a look at it and see if removing the cache causes any issues?\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/laravel/framework/issues/comments/239795789","html_url":"https://github.com/laravel/framework/pull/14824#issuecomment-239795789","issue_url":"https://api.github.com/repos/laravel/framework/issues/14824","id":239795789,"user":{"login":"GrahamCampbell","id":2829600,"avatar_url":"https://avatars.githubusercontent.com/u/2829600?v=3","gravatar_id":"","url":"https://api.github.com/users/GrahamCampbell","html_url":"https://github.com/GrahamCampbell","followers_url":"https://api.github.com/users/GrahamCampbell/followers","following_url":"https://api.github.com/users/GrahamCampbell/following{/other_user}","gists_url":"https://api.github.com/users/GrahamCampbell/gists{/gist_id}","starred_url":"https://api.github.com/users/GrahamCampbell/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GrahamCampbell/subscriptions","organizations_url":"https://api.github.com/users/GrahamCampbell/orgs","repos_url":"https://api.github.com/users/GrahamCampbell/repos","events_url":"https://api.github.com/users/GrahamCampbell/events{/privacy}","received_events_url":"https://api.github.com/users/GrahamCampbell/received_events","type":"User","site_admin":false},"created_at":"2016-08-15T13:00:20Z","updated_at":"2016-08-15T13:00:20Z","body":"I agree with Joseph. Never access auth in a controller constructor."}}
{"actor":{"display_login":"GrahamCampbell"}}