fix:add _method in useForm to keep using PATCH on routes and POST in Frontend spoofing as PATCH

Author: Igor-Ponso

app/Http/Controllers/Settings/ProfileController.php

@@ -28,23 +28,23 @@ public function edit(Request $request): Response
     /**
      * Update the user's profile information.
      */
-    public function update(ProfileUpdateRequest $request): RedirectResponse
+    public function update(Request $request): RedirectResponse
     {
         $user = $request->user();
 
-        $user->fill($request->only(['name', 'email']));
+        $user->fill($request->validated());
+
+        if ($user->isDirty('email')) {
+            $user->email_verified_at = null;
+        }
 
         if ($request->hasFile('profile_photo')) {
-            // delete old avatar if exists
             if ($user->profile_photo_path && Storage::exists($user->profile_photo_path)) {
                 Storage::delete($user->profile_photo_path);
             }
 
-            // save new avatar
             $path = $request->file('profile_photo')->store('avatars', 'public');
             $user->profile_photo_path = $path;
-        } else {
-            $user->profile_photo_path = null;
         }
 
         $user->save();

app/Models/User.php

@@ -36,6 +36,11 @@ class User extends Authenticatable
         'profile_photo_path',
     ];
 
+    /**
+     * The attributes that should be cast.
+     *
+     * @var array<string, string>
+     */
     protected $appends = [
         'avatar',
     ];

resources/js/pages/settings/Profile.vue

@@ -50,6 +50,7 @@ const form = useForm({
     name: user.name,
     email: user.email,
     profile_photo: null as File | null,
+    _method: 'PATCH',
 });
 
 const handleAvatarChange = (event: Event) => {
@@ -96,7 +97,7 @@ const avatarSrc = computed(() => {
                         <div class="group relative">
                             <label for="avatar-upload" class="cursor-pointer" aria-label="Upload avatar">
                                 <Avatar size="lg">
-                                    <AvatarImage :src="avatarSrc || user.avatar" alt="User avatar" />
+                                    <AvatarImage :src="avatarSrc || user.avatar || ''" alt="User avatar" />
                                     <AvatarFallback>{{ getInitials(user.name) }}</AvatarFallback>
                                 </Avatar>
                             </label>

routes/settings.php

@@ -9,7 +9,7 @@
     Route::redirect('settings', '/settings/profile');
 
     Route::get('settings/profile', [ProfileController::class, 'edit'])->name('profile.edit');
-    Route::post('settings/profile', [ProfileController::class, 'update'])->name('profile.update');
+    Route::patch('settings/profile', [ProfileController::class, 'update'])->name('profile.update');
     Route::delete('settings/profile', [ProfileController::class, 'destroy'])->name('profile.destroy');
 
     Route::get('settings/password', [PasswordController::class, 'edit'])->name('password.edit');