Fix restoration of deleted icon when updating an account - Fixes #408

Bubka · Nov 22, 2024 · 4464105 · 4464105
1 parent ec26f19
commit 4464105
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 2 deletions.
diff --git a/app/Api/v1/Controllers/TwoFAccountController.php b/app/Api/v1/Controllers/TwoFAccountController.php
@@ -106,8 +106,8 @@ public function update(TwoFAccountUpdateRequest $request, TwoFAccount $twofaccou
         $this->authorize('update', $twofaccount);
 
         $validated = $request->validated();
-
-        $twofaccount->fillWithOtpParameters($validated);
+        
+        $twofaccount->fillWithOtpParameters($validated, $twofaccount->icon && is_null(Arr::get($validated, 'icon', null)));
         $request->user()->twofaccounts()->save($twofaccount);
 
         // Possible group change

diff --git a/tests/Api/v1/Controllers/TwoFAccountControllerTest.php b/tests/Api/v1/Controllers/TwoFAccountControllerTest.php
@@ -815,6 +815,29 @@ public function test_update_twofaccount_of_another_user_is_forbidden()
             ]);
     }
 
+    #[Test]
+    public function test_update_with_removed_icon_prevents_official_logo_fetching()
+    {
+        $attributes = ([
+            'otp_type'   => 'totp',
+            'account'    => OtpTestData::ACCOUNT,
+            'service'    => OtpTestData::SERVICE,
+            'secret'     => OtpTestData::SECRET,
+            'algorithm'  => OtpTestData::ALGORITHM_DEFAULT,
+            'digits'     => OtpTestData::DIGITS_DEFAULT,
+            'period'     => OtpTestData::PERIOD_DEFAULT,
+            'legacy_uri' => OtpTestData::TOTP_SHORT_URI,
+            'icon'       => 'icon.png',
+        ]);
+        $twofaccount = TwoFAccount::factory()->for($this->user)->create($attributes);
+        $attributes['icon'] = '';
+
+        $response = $this->actingAs($this->user, 'api-guard')
+            ->json('PUT', '/api/v1/twofaccounts/' . $twofaccount->id, $attributes);
+
+        $this->assertNull($response->json('icon'));
+    }
+
     #[Test]
     public function test_migrate_valid_gauth_payload_returns_success_with_consistent_resources()
     {