Spamschutz Kontakt + Registrierung: Turnstile, Rate-Limit, Honeypot; Passwort min. 8

- Kontaktformular: keine Mail mehr an die eingegebene Adresse (wurde als
  Spam-Versender missbraucht); Anfrage nur an Kontakt-Adresse + Berater (BCC),
  Reply-To = Absender; Eingaben in der Mail escaped
- Kontakt + Registrierung: Cloudflare Turnstile statt reCAPTCHA (Schluessel
  aus dem Code in die .env), Rate-Limits, Honeypot + Mindest-Ausfuellzeit,
  Namensregel (lateinische Schrift, max. 50 Zeichen), Form Requests
- Registrierung: Partner-Nummer nur fuer aktive Berater (vorher ungeprueft)
- CRM: POST /register abgeschaltet (legte ohne Captcha Benutzer an)
- Passwort-Mindestlaenge systemweit 8 Zeichen ueber Password::defaults()
- Log abgefangener Anfragen: storage/logs/form-spam-*.log
- Doku und Protokoll: dev/2026-10-09-spam/README.md

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/Http/Controllers/UserUpdatePasswordController.php

@@ -1,39 +1,38 @@
 <?php
 
-
 namespace App\Http\Controllers;
 
 use Auth;
+use Illuminate\Contracts\View\Factory;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Routing\Redirector;
 use Illuminate\Support\Facades\Hash;
-use Validator;
+use Illuminate\Validation\Rules\Password;
+use Illuminate\View\View;
 use Request;
-
+use Validator;
 
 class UserUpdatePasswordController extends Controller
 {
-
-
     public function __construct()
     {
         $this->middleware('auth');
     }
 
     /**
-     * @return \Illuminate\Contracts\View\Factory|\Illuminate\View\View
+     * @return Factory|View
      */
     public function updatePassword()
     {
         return view('user.update_password');
     }
 
-
-   
     public function updatePasswordStore()
     {
-        $rules = array(
-            'old_password' => 'required|old_password:' . Auth::user()->password,
-            'password' => 'required|string|min:8|confirmed',
-        );
+        $rules = [
+            'old_password' => 'required|old_password:'.Auth::user()->password,
+            'password' => ['required', 'string', 'confirmed', Password::defaults()],
+        ];
 
         Validator::extend('old_password', function ($attribute, $value, $parameters, $validator) {
 
@@ -47,6 +46,7 @@ class UserUpdatePasswordController extends Controller
 
             // get the error messages from the validator
             $messages = $validator->messages();
+
             // redirect our user back to the form with the errors from the validator
             return view('user.update_password')->withErrors($validator);
 
@@ -54,33 +54,32 @@ class UserUpdatePasswordController extends Controller
         $user = Auth::user();
         $data = Request::all();
         $user->fill([
-            'password' => Hash::make($data['password'])
+            'password' => Hash::make($data['password']),
         ])->save();
 
-
         \Session()->flash('alert-save', '1');
+
         return redirect(route('user_update_password'));
 
     }
 
-
     /**
-     * @return \Illuminate\Contracts\View\Factory|\Illuminate\Http\RedirectResponse|\Illuminate\Routing\Redirector|\Illuminate\View\View
+     * @return Factory|RedirectResponse|Redirector|View
      */
-    public function updatePasswordFirst(){
-        if(!Auth::user()->isPasswort()){
+    public function updatePasswordFirst()
+    {
+        if (! Auth::user()->isPasswort()) {
             return view('user.update_password_first');
         }
+
         return redirect(route('user_update_password'));
     }
 
-   
     public function updatePasswordFirstStore()
     {
-        $rules = array(
-            'password' => 'required|string|min:6|confirmed',
-        );
-
+        $rules = [
+            'password' => ['required', 'string', 'confirmed', Password::defaults()],
+        ];
 
         $validator = Validator::make(Request::all(), $rules);
 
@@ -88,6 +87,7 @@ class UserUpdatePasswordController extends Controller
 
             // get the error messages from the validator
             $messages = $validator->messages();
+
             // redirect our user back to the form with the errors from the validator
             return view('user.update_password_first')->withErrors($validator);
 
@@ -95,12 +95,11 @@ class UserUpdatePasswordController extends Controller
         $user = Auth::user();
         $data = Request::all();
         $user->fill([
-            'password' => Hash::make($data['password'])
+            'password' => Hash::make($data['password']),
         ])->save();
 
-
-
         \Session()->flash('alert-save', '1');
+
         return redirect('/home');
     }
-}
+}