{"action":"created","issue":{"url":"https://api.github.com/repos/laravel/framework/issues/27045","repository_url":"https://api.github.com/repos/laravel/framework","labels_url":"https://api.github.com/repos/laravel/framework/issues/27045/labels{/name}","comments_url":"https://api.github.com/repos/laravel/framework/issues/27045/comments","events_url":"https://api.github.com/repos/laravel/framework/issues/27045/events","html_url":"https://github.com/laravel/framework/issues/27045","id":395588466,"node_id":"MDU6SXNzdWUzOTU1ODg0NjY=","number":27045,"title":"Password Reset Email does not take into account a subdomain, if it's being used.","user":{"login":"danmatthews","id":149426,"node_id":"MDQ6VXNlcjE0OTQyNg==","avatar_url":"https://avatars2.githubusercontent.com/u/149426?v=4","gravatar_id":"","url":"https://api.github.com/users/danmatthews","html_url":"https://github.com/danmatthews","followers_url":"https://api.github.com/users/danmatthews/followers","following_url":"https://api.github.com/users/danmatthews/following{/other_user}","gists_url":"https://api.github.com/users/danmatthews/gists{/gist_id}","starred_url":"https://api.github.com/users/danmatthews/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danmatthews/subscriptions","organizations_url":"https://api.github.com/users/danmatthews/orgs","repos_url":"https://api.github.com/users/danmatthews/repos","events_url":"https://api.github.com/users/danmatthews/events{/privacy}","received_events_url":"https://api.github.com/users/danmatthews/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2019-01-03T14:18:05Z","updated_at":"2019-01-03T14:31:50Z","closed_at":null,"author_association":"NONE","body":"- Laravel Version: 5.7.9\r\n- PHP Version: 7.2.11\r\n- Database Driver & Version: Mysql, 5.7.20\r\n\r\n### Description:\r\n\r\nWhen `Auth::routes()` is registered from within a `Route::group` that uses the subdomain option, the reset email still only links to the root domain. This isn't ideal for those using subdomains to provide people with their own unique accounts.\r\n\r\nI believe this is related to commit cef10551820530632a86fa6f1306fee95c5cac43 where the APP_URL is added to ensure hostname security. Unfortunately, this breaks dynamic generation that `url()` would typically handle if the hostname wasn't included as part of the argument string.\r\n\r\n\r\n### Steps To Reproduce:\r\n\r\nCreate a route group for wildcard subdomains, then register the auth routes within that.\r\n\r\n```php\r\nRoute::domain('{subdomain}.'.env('APP_DOMAIN'))->group(function() {\r\n    Auth::routes();\r\n});\r\n```\r\n\r\nI also have a middleware registered that adds the domain as a URL param:\r\n\r\n```php\r\n$subdomain = $request->route()->parameter('subdomain');\r\nif ($subdomain) {\r\n  if ($subdomain != 'admin') {\r\n    // Sends a 404 if the organisation doesn't exist.\r\n    Organisation::where('url', $request->route()->parameter('subdomain'))->firstOrFail();\r\n  }\r\n}\r\n\r\nURL::defaults([\r\n     'subdomain' => isset($subdomain) ? $subdomain : null,\r\n]);\r\n```\r\n\r\nThen visit `myrealsubdomain.myapp.com/password/reset` and submit a password reset request - the URL on the action button will contain the value of `APP_URL`, without the subdomain."},"comment":{"url":"https://api.github.com/repos/laravel/framework/issues/comments/451159571","html_url":"https://github.com/laravel/framework/issues/27045#issuecomment-451159571","issue_url":"https://api.github.com/repos/laravel/framework/issues/27045","id":451159571,"node_id":"MDEyOklzc3VlQ29tbWVudDQ1MTE1OTU3MQ==","user":{"login":"danmatthews","id":149426,"node_id":"MDQ6VXNlcjE0OTQyNg==","avatar_url":"https://avatars2.githubusercontent.com/u/149426?v=4","gravatar_id":"","url":"https://api.github.com/users/danmatthews","html_url":"https://github.com/danmatthews","followers_url":"https://api.github.com/users/danmatthews/followers","following_url":"https://api.github.com/users/danmatthews/following{/other_user}","gists_url":"https://api.github.com/users/danmatthews/gists{/gist_id}","starred_url":"https://api.github.com/users/danmatthews/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/danmatthews/subscriptions","organizations_url":"https://api.github.com/users/danmatthews/orgs","repos_url":"https://api.github.com/users/danmatthews/repos","events_url":"https://api.github.com/users/danmatthews/events{/privacy}","received_events_url":"https://api.github.com/users/danmatthews/received_events","type":"User","site_admin":false},"created_at":"2019-01-03T14:31:50Z","updated_at":"2019-01-03T14:31:50Z","author_association":"NONE","body":"For the record, i've worked around it by setting `APP_URL` at runtime in `sendResetEmailLink`\r\n\r\n```php\r\n\r\npublic function sendResetLinkEmail(Request $request)\r\n    {\r\n        $this->validateEmail($request);\r\n        config(['app.url' => url('/')]);\r\n        // We will send the password reset link to this user. Once we have attempted\r\n        // to send the link, we will examine the response then see the message we\r\n        // need to show to the user. Finally, we'll send out a proper response.\r\n        $response = $this->broker()->sendResetLink(\r\n            $request->only('email')\r\n        );\r\n\r\n        return $response == Password::RESET_LINK_SENT\r\n            ? $this->sendResetLinkResponse($request, $response)\r\n            : $this->sendResetLinkFailedResponse($request, $response);\r\n    }\r\n\r\n```"}}
{"actor":{"display_login":"danmatthews"}}