- Kontaktformular: keine Mail mehr an die eingegebene Adresse (wurde als Spam-Versender missbraucht); Anfrage nur an Kontakt-Adresse + Berater (BCC), Reply-To = Absender; Eingaben in der Mail escaped - Kontakt + Registrierung: Cloudflare Turnstile statt reCAPTCHA (Schluessel aus dem Code in die .env), Rate-Limits, Honeypot + Mindest-Ausfuellzeit, Namensregel (lateinische Schrift, max. 50 Zeichen), Form Requests - Registrierung: Partner-Nummer nur fuer aktive Berater (vorher ungeprueft) - CRM: POST /register abgeschaltet (legte ohne Captcha Benutzer an) - Passwort-Mindestlaenge systemweit 8 Zeichen ueber Password::defaults() - Log abgefangener Anfragen: storage/logs/form-spam-*.log - Doku und Protokoll: dev/2026-10-09-spam/README.md Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
104 lines
4.1 KiB
PHP
104 lines
4.1 KiB
PHP
<?php
|
|
|
|
namespace App\Providers;
|
|
|
|
use App\Services\Backoffice\BackofficeDashboardService;
|
|
use App\Services\Payment\Payone\PayonePaymentService;
|
|
use App\Services\Payment\Stripe\StripeClientWrapper;
|
|
use App\Services\Util;
|
|
use App\Support\OperationalAlert;
|
|
use App\Support\Validation\Validator as SafeEmailValidator;
|
|
use Barryvdh\LaravelIdeHelper\IdeHelperServiceProvider;
|
|
use Illuminate\Foundation\Console\AboutCommand;
|
|
use Illuminate\Pagination\Paginator;
|
|
use Illuminate\Queue\Events\JobFailed;
|
|
use Illuminate\Support\Facades\Queue;
|
|
use Illuminate\Support\Facades\Schema;
|
|
use Illuminate\Support\Facades\URL;
|
|
use Illuminate\Support\Facades\Validator;
|
|
use Illuminate\Support\ServiceProvider;
|
|
use Illuminate\Validation\Rules\Password;
|
|
|
|
class AppServiceProvider extends ServiceProvider
|
|
{
|
|
/**
|
|
* Bootstrap any application services.
|
|
*
|
|
* @return void
|
|
*/
|
|
public function boot()
|
|
{
|
|
Schema::defaultStringLength(191);
|
|
Validator::resolver(fn ($translator, $data, $rules, $messages, $attributes) => new SafeEmailValidator($translator, $data, $rules, $messages, $attributes));
|
|
// Mindestanforderung für alle neu gesetzten Passwörter (Registrierung, Wizard, Ändern, Zurücksetzen)
|
|
Password::defaults(fn () => Password::min(8));
|
|
Paginator::defaultView('pagination::bootstrap-4');
|
|
Paginator::defaultSimpleView('pagination::simple-bootstrap-4');
|
|
|
|
if ($this->app->environment('production')) {
|
|
URL::forceScheme('https');
|
|
}
|
|
|
|
Queue::failing(function (JobFailed $event): void {
|
|
OperationalAlert::send('Queue-Job fehlgeschlagen: '.$event->job->resolveName(), [
|
|
'connection' => $event->connectionName,
|
|
'queue' => $event->job->getQueue(),
|
|
'exception' => $event->exception->getMessage(),
|
|
]);
|
|
});
|
|
|
|
AboutCommand::add('mivita', fn (): array => [
|
|
'Version' => config('app.version') ?? 'unbekannt',
|
|
]);
|
|
|
|
// Domain-bewusster View Composer für user_shop
|
|
// HOTFIX: DomainContext temporär deaktiviert
|
|
// TODO: Nach Claude v2 Implementation wieder aktivieren
|
|
\View::composer('*', function ($view) {
|
|
try {
|
|
// $context = app(\App\Domain\DomainContext::class);
|
|
// if ($context->type === 'main') {
|
|
// $view->with('user_shop', null);
|
|
// } else {
|
|
// $userShop = $context->userShop ?? \App\Services\Util::getUserShop();
|
|
// $view->with('user_shop', $userShop);
|
|
// }
|
|
|
|
// Temporär: Verwende immer das normale Verhalten
|
|
$view->with('user_shop', Util::getUserShop());
|
|
} catch (\Exception $e) {
|
|
// Fallback bei Fehlern
|
|
$view->with('user_shop', Util::getUserShop());
|
|
}
|
|
});
|
|
}
|
|
|
|
/**
|
|
* Register any application services.
|
|
*
|
|
* @return void
|
|
*/
|
|
public function register()
|
|
{
|
|
// PAYONE payment service: built from merchant defaults, real Guzzle client at runtime.
|
|
// The per-request `mode` is always passed explicitly to the service methods, so the
|
|
// shared singleton needs only the base defaults from config.
|
|
$this->app->singleton(PayonePaymentService::class, function () {
|
|
return new PayonePaymentService(config('payone.defaults'));
|
|
});
|
|
|
|
// Stripe: lazy Client-Hülle; Hard-Fail erst bei Nutzung ohne STRIPE_SECRET
|
|
// (Dark-Launch-fähig, siehe config/stripe.php + dev/2026-07-08-stripe/).
|
|
$this->app->singleton(StripeClientWrapper::class, function () {
|
|
return new StripeClientWrapper(config('stripe.secret'));
|
|
});
|
|
|
|
// Dashboard-Services teilen die Baum-Traversierung (lineBuckets-Memo):
|
|
// als Singleton läuft die Downline-BFS pro Request/Prozess nur einmal je Root.
|
|
$this->app->singleton(BackofficeDashboardService::class);
|
|
|
|
if ($this->app->environment() !== 'production' && class_exists(IdeHelperServiceProvider::class)) {
|
|
$this->app->register(IdeHelperServiceProvider::class);
|
|
}
|
|
}
|
|
}
|