10.April 2026

app/Http/Middleware/Localization.php

@@ -2,29 +2,37 @@
 
 namespace App\Http\Middleware;
 
-use Carbon;
+use App\Services\LocaleGuard;
 use Closure;
-use Auth;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\App;
+use Illuminate\Support\Facades\Session;
 
 class Localization
 {
     /**
-     * Handle an incoming request.
+     * Session locale must be validated: arbitrary strings break Symfony/Carbon
+     * (e.g. scanner payloads stored as "locale").
      *
-     * @param  \Illuminate\Http\Request  $request
-     * @param  \Closure  $next
-     * @return mixed
+     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
      */
-
-    public function handle($request, Closure $next)
+    public function handle(Request $request, Closure $next): mixed
     {
-        if (\Session::has('locale')) {
-            \App::setLocale(\Session::get('locale'));
-            // Carbon::setLocale('\Session::get('locale')');
-            //Carbon::setLocale('de');
+        if (! Session::has('locale')) {
+            return $next($request);
         }
 
+        $raw = Session::get('locale');
+        $normalized = LocaleGuard::normalize(is_string($raw) ? $raw : null);
+
+        if ($normalized !== null) {
+            App::setLocale($normalized);
+
+            return $next($request);
+        }
+
+        Session::forget('locale');
+
         return $next($request);
     }
-
 }