Snapey

I didn't say it was not possible to brute force the other way, but you are putting extra steps into the process that take time. You can also add Recaptcha or a honeypot to the form.

Anyway, rate limit the requests in some way rather than having an open token validation service.

active departments or active subjects?

What I would do is create a relationship which is scoped

eg, departments model

    public function activeSubjects()
    {
        return $this->hasMany(Subject::class)->where('active',1);
    } 

then eager load

$user->colleges()->with( 'departments.activeSubjects')->paginate(10);

bear in mind that you will need to loop over activeSubjects not subjects

You will get a better response to your questions if you state WHAT error you get

still a problem?

The very first thing you should do is check you get a valid id into the controller since you are using findOrFail

But, you say that the data is saved ? Then the 404 is generated by the show route. You should test this on its own by loading that page on its own, manually entering the id in the address bar

Name the element using the id rather than trying to pass it as a value

	<input
		@foreach($file->product_types as $file_product)
			@if($file_product->id == $product_type->id)
				checked
			@endif
		@endforeach
		type="checkbox" name="product_type[{{$product_type->id}}]"
		value="1">

Now in the controller you will have an array of product_type like

[
 23 => 1,
 45 => 1,
 88 => 1,
]

where 23,45 and 88 are product_type IDs

Now you can loop over the array using the Key as the ID of the product to detach

You also need to alter your check for the checked state since you will have more checkboxes than product_type so you have to look to see if your array of attached models contains the current option.

Why do you have that hidden input there?

Not a Laravel Question. Try this;

<script>
   $(document).ready(function () {
     $('.leaveDate').datetimepicker({
       format: 'MM/DD/YYYY',
       changeYear: false,
       locale: 'en'
    });

     $('.dobDate').datetimepicker({
       format: 'MM/DD/YYYY',
       maxDate:0,
       locale: 'en'
    });

  });

Current year is most easily accomplished by not letting the user change the year

DOB is most easily accomplished as an offset 0 days from today.

Both are theoretical based on reading the API

https://api.jqueryui.com/datepicker/#option-maxDate

@amitshahc

Beware of validating the token before getting any more details from the user. It gives an endpoint that someone can just keep sending random tokens hoping for a match.

They come to your site, with a known user name, trigger password reset then start blasting the route with random tokens. If they get the right one before the account owner knows something is happening then they are in to your site as that user.

go into the config file filesystems.php and create a new entry below public

        'public' => [
            'driver' => 'local',
            'root' => storage_path('app/public'),
            'url' => env('APP_URL').'/storage',
            'visibility' => 'public',
        ],

        'upload' => [
            'driver' => 'local',
            'root' => public_path('upload'),
            'url' => env('APP_URL').'/upload',
            'visibility' => 'public',
        ],

Now you have a file system disk called upload which refers to this folder within the public folder (not to be confused with the public disk)

change your controller;

    {
        $this->validate($request, [
            'name' => 'required|min:3',
            'time' => 'required|min:3',
            'description' => 'required|min:10',
            'file' => 'required|file|max:2048'
        ]);

        $path = $request->file('file')->store('/','upload');

        $post = Post::create([
            'name' => $request->name,
            'time' => $request->time,
            'description' => $request->description,
            'file_title' => $upload->getClientOriginalName(),
            'file' => $path,
            'user_id' => Auth::user()->id
        ]);

        return redirect()->route('givePrice', $post->id);
        }

So, now, in your database, you will just have the filename and no path attached. But you know it is in the upload disk.

<img src="{{ asset('upload/' . $post->file }}" >

With user relation to salesorder, you can instead do

$salesorder = Auth::user()->salesorder()->create($salesorder);

With user relation to salesorder, you can instead do

$salesorder = Auth::user()->salesorder()->create($salesorder);

One route, one controller method.

That controller method needs to return all the data needed for the page, or you are into using ajax to 'pull' the data into the page from the client.

because wordpress updates itself?

Did you set SESSION_DRIVER in the .env file and then run php artisan config:clear ?

(or remove SESSION_DRIVER from .env)

Does html2pdf understand flexbox?

Are applications written 10 years ago still safe... probably not. Yet at the time, we thought we were using best practices. But still, people discover issues and then exploit those issues on servers that have not been patched.

To think that you can get away with not updating a site for that long is just burying your head in the sand. Besides, we may all be using new devices by then, we will have different design standards, there may be legal requirements regarding all websites for security and accessibility.

The web is a constantly developing thing. Not a book.

Did you set SESSION_DRIVER in the .env file and then run php artisan config:clear ?

(or remove SESSION_DRIVER from .env)

Why would you go to all that trouble when you can just save the file to public/images or similar

I read this every so often. Nothing there about traits though

https://phptherightway.com/

If you are clicking on an anchor , eg <a href="#" then you need to use prevent default to stop the click event causing a page reload.

try

	$('.try').click(function(e){

		e.preventDefault();

		etc

No, you can't do route model binding with soft deleted models.

No, you can't do route model binding with soft deleted models.

Are applications written 10 years ago still safe... probably not. Yet at the time, we thought we were using best practices. But still, people discover issues and then exploit those issues on servers that have not been patched.

To think that you can get away with not updating a site for that long is just burying your head in the sand. Besides, we may all be using new devices by then, we will have different design standards, there may be legal requirements regarding all websites for security and accessibility.

The web is a constantly developing thing. Not a book.

right click the bar and make sure method is checked.

There is nothing to choose between them, but feel free to try it in firefox if you have it

You are looking for a row with a method of POST - assuming your form is actually being submitted

You can put something in the user's session that says they are viewing the alternate menu. When they go away , their session will expire. You cannot force it to expire because you don't know they have gone away.

You can set the session cookie to expire when they close their browser, but that is just a flag on the cookie you send them and they are not forced to close the browser.

Could it be that you cannot read from the tmp folder? I've seen some weird issues with people that have the tmp path locked down.

I assume during the upload, you are moving the file from php's temp folder to the final destination.

@jeffreyway I'm still not getting mentions.

With the network tab open

Click on the submit button of your form

In the network log, you should see an entry for POST

Click this, then look in the details panel. You are looking for the request. In Chrome click the name of the route in the very first column, you will then get a split screen. Select 'headers' in the new panel. Scroll to the bottom and there you will see Form Data

In Firefox its basically the same process, but the form data is on the Request tab

I would first look at the browser source and check that both checkboxes are present in the source and have different names, and they are both inside the same form as the submit button

Then I would open the network tab in the developer tools, make a post with both checkboxes clicked and see what is sent to the server in the request.

One route, one controller method.

That controller method needs to return all the data needed for the page, or you are into using ajax to 'pull' the data into the page from the client.

@keithmclaughlin

• makes you forget how to create basic form elements
• Uses hard to remember parameter passing (was the class the third parameter or the fourth)
• redundant now that we can easily create components in Laravel 7

I don't really understand your use case, but;

For instance

$user = UserVerification::find(verification_id)->user()->get(['name','email']);

return $user;

or

$verification = UserVerification::with('user:name,email')->find(verification_id);

return $verification;

in tinker,

>>>  DB::connection()->enableQueryLog()

>>> App\Provider::with('currency')->first()

>>> DB::getQueryLog()

Try it also for your working query

Does Bidding contain a relationship to User ?

ha, good luck with that.

How do you expect the code to be executed when you don't provide a routable URL?

it means your webserver does not have permission to write to the storage folder to create the logs directory.

Check your permissions on the storage folder and make sure it is group writable or owned by your web server user (usually www-data)

I don't really understand your use case, but;

For instance

$user = UserVerification::find(verification_id)->user()->get(['name','email']);

return $user;

or

$verification = UserVerification::with('user:name,email')->find(verification_id);

return $verification;

run instead php artisan route:clear

When you run optimise, it clears the route cache, then re-caches it. Your routes then cannot be changed until you clear the cache again.

Only use optimise in production.

Please format your code by putting 3 backticks ``` on a line before and after each code block

Assuming your migrations have worked correctly, the comments table should definitely have the conversations_id column

Can you check it is there with your DB admin tool

or

$user = UserVerification::find(verification_id)->user;

return $user;

This works also, and what I meant

return redirect(signedRoute('projets.draft', ['project' => $project]));

OK we'll start with the basics

At the end of your store method, you should return a redirect, not a url.

I'm assuming you want to go to the new project, but with a signed URL?

            return redirect(signedRoute('projets.draft', ['project' => $project]);

OK we'll start with the basics

At the end of your store method, you should return a redirect, not a url.

I'm assuming you want to go to the new project, but with a signed URL?

            return redirect(signedRoute('projets.draft', ['project' => $project]);

what DO you get?

no its only the admin and there is no need for bob to view it again

If the admin needs to see the image through the web interface then there is no difference between bob and the admin. The image needs to be stored in a public place if you want to see it through the admin interface.

show how you save these images and I'll show you how to adapt it

ok now ? please mark solved

    public function store(SectionRequest $request)
    {

	$active = ['active' => $request->has('active') ? 1, 0];

        Section::create($request->except(['_token']) + $active);

        return redirect()->route('section.index')->with(['success' => 'Section created']);
    }

run instead php artisan route:clear

When you run optimise, it clears the route cache, then re-caches it. Your routes then cannot be changed until you clear the cache again.

Only use optimise in production.

    public function store(SectionRequest $request)
    {

	$active = ['active' => $request->has('active') ? 1, 0];

        Section::create($request->except(['_token']) + $active);

        return redirect()->route('section.index')->with(['success' => 'Section created']);
    }

No, its because you are not causing any validation errors. What in the code you show would return an error?

If login fails, you just return back. This will not contain anything to trigger $error