404 pages are protected (statamic#7714)

AKIATSU · Mar 16, 2023 · fc1c20a · fc1c20a
1 parent 85a8a6a
commit fc1c20a
Show file tree

Hide file tree

Showing 2 changed files with 19 additions and 0 deletions.
diff --git a/src/Http/Controllers/FrontendController.php b/src/Http/Controllers/FrontendController.php
@@ -3,6 +3,7 @@
 namespace Statamic\Http\Controllers;
 
 use Illuminate\Http\Request;
+use Statamic\Auth\Protect\Protection;
 use Statamic\Exceptions\NotFoundHttpException;
 use Statamic\Facades\Data;
 use Statamic\Http\Responses\DataResponse;
@@ -30,6 +31,8 @@ public function index(Request $request)
             return $data;
         }
 
+        app(Protection::class)->protect();
+
         throw new NotFoundHttpException;
     }
 

diff --git a/tests/FrontendTest.php b/tests/FrontendTest.php
@@ -11,6 +11,7 @@
 use Statamic\Facades\Blueprint;
 use Statamic\Facades\Collection;
 use Statamic\Facades\Site;
+use Statamic\Facades\User;
 use Statamic\Tags\Tags;
 use Statamic\View\Antlers\Language\Utilities\StringUtilities;
 
@@ -834,4 +835,19 @@ public function redirectProvider()
             ],
         ];
     }
+
+    /** @test */
+    public function it_protects_404_pages()
+    {
+        $this->get('/does-not-exist')->assertStatus(404);
+
+        config(['statamic.protect.default' => 'logged_in']);
+
+        $this->get('/does-not-exist')->assertRedirect('/login?redirect=http://localhost/does-not-exist');
+
+        $this
+            ->actingAs(User::make())
+            ->get('/does-not-exist')
+            ->assertStatus(404);
+    }
 }