Index: app/Http/Controllers/Auth/CreatePasswordController.php
===================================================================
--- app/Http/Controllers/Auth/CreatePasswordController.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
+++ app/Http/Controllers/Auth/CreatePasswordController.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Requests\Auth\CreatePasswordRequest;
+use App\Models\User;
+use App\Http\Controllers\Controller;
+
+class CreatePasswordController extends Controller
+{
+    public function __construct()
+    {
+        $this->middleware("createPassword");
+    }
+
+    public function showCreatePassword($id, $token)
+    {
+        return view("auth.create_password")->with([
+            "id" => $id,
+            "token" => $token
+        ]);
+    }
+
+    public function createPassword(CreatePasswordRequest $request, $id, $token)
+    {
+        $user = User::find($id);
+
+        $user->password = bcrypt($request->password);
+        $user->is_active = true;
+        $user->is_confirmed = true;
+
+        if ($user->is_forgot_password) {
+            $user->is_forgot_password = false;
+        }
+
+        $user->save();
+
+        return redirect()->route("auth.loginShow");
+    }
+}
Index: app/Http/Controllers/Auth/ForgotPasswordController.php
===================================================================
--- app/Http/Controllers/Auth/ForgotPasswordController.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
+++ app/Http/Controllers/Auth/ForgotPasswordController.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Requests\Auth\ForgotPasswordRequest;
+use App\Models\User;
+use App\Http\Controllers\Controller;
+use App\Notifications\ForgotPassword;
+
+class ForgotPasswordController extends Controller
+{
+    public function __construct()
+    {
+        $this->middleware("guest");
+    }
+
+    public function showForgotPassword()
+    {
+        return view("auth.forgot");
+    }
+
+    public function forgotPassword(ForgotPasswordRequest $request)
+    {
+        $user = User::where("email", $request->email)->first();
+
+        $user->is_forgot_password = true;
+        $user->is_active = false;
+        $user->security_code = $user->generateSecurityCode();
+        $user->verify_token = $user->generateVerifyToken();
+
+        $user->save();
+
+        $user->notify(new ForgotPassword($user));
+
+        $request->session()->flash("forgotInfo", "We have sent an email to your inbox.");
+
+        return redirect()->route("auth.forgotShow");
+    }
+}
Index: app/Http/Controllers/Auth/LoginController.php
===================================================================
--- app/Http/Controllers/Auth/LoginController.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
+++ app/Http/Controllers/Auth/LoginController.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
@@ -0,0 +1,69 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Requests\Auth\LoginRequest;
+use App\Models\User;
+use App\Http\Controllers\Controller;
+use Illuminate\Support\Facades\Hash;
+
+class LoginController extends Controller
+{
+    protected $redirectTo = '/dashboard';
+
+    public function __construct()
+    {
+        $this->middleware("guest")->except('logout');
+    }
+
+    public function showLogin()
+    {
+        return view("auth.login");
+    }
+
+    public function login(LoginRequest $request)
+    {
+        $user = User::whereUsername($request->username)->first();
+
+        if (!$user->is_active) {
+            $request->session()->flash("isActiveError", "Your account is blocked or its not confirmed yet. Please contact with your system administrator or check your email.");
+            return redirect()->back();
+        }
+
+        if (!Hash::check($request->password, $user->password)) {
+            $request->session()->flash("passwordError", "Your password is incorrect");
+            return redirect()->back()->withInput($request->input());
+        }
+
+        if (auth()->attempt([
+            "username" => $request->username,
+            "password" => $request->password,
+            "is_active" => true], $request->remember)) {
+
+            $user->is_online = true;
+            $user->save();
+
+            return redirect()->intended('/dashboard');
+        }
+
+        if ($user->is_forgot_password) {
+            $user->is_forgot_password = false;
+        }
+
+        $request->session()->flash("loginError", "An error occurred while login. Please try again later.");
+
+        return redirect()->back()->withInput($request->input());
+    }
+
+    public function logout()
+    {
+
+        $user = auth()->user();
+        $user->is_online = false;
+        $user->save();
+
+        auth()->logout();
+
+        return redirect("/auth/login");
+    }
+}
Index: app/Http/Controllers/Auth/VerifyNewEmailController.php
===================================================================
--- app/Http/Controllers/Auth/VerifyNewEmailController.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
+++ app/Http/Controllers/Auth/VerifyNewEmailController.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Http\Controllers\Auth;
+
+use App\Http\Requests\Auth\VerifyNewEmailRequest;
+use App\Models\User;
+use App\Http\Controllers\Controller;
+
+class VerifyNewEmailController extends Controller
+{
+    public function __construct()
+    {
+        $this->middleware("checkVerifyNewEmail");
+    }
+
+    public function create($id, $token)
+    {
+        return view("auth.verify")->with([
+            "id" => $id,
+            "token" => $token
+        ]);
+    }
+
+    public function verify(VerifyNewEmailRequest $request, $id, $token)
+    {
+        $user = User::find($id);
+        $user->is_active = true;
+        $user->save();
+
+        return redirect()->route("auth.login");
+    }
+}
Index: app/Http/Kernel.php
===================================================================
--- app/Http/Kernel.php	(revision 2fc88eca8e50b236d520d00f243f96eef97ae67f)
+++ app/Http/Kernel.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
@@ -22,4 +22,5 @@
         \App\Http\Middleware\TrimStrings::class,
         \Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull::class,
+        \App\Http\Middleware\CheckForMaintenanceMode::class,
     ];
 
@@ -64,4 +65,9 @@
         'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class,
         'verified' => \Illuminate\Auth\Middleware\EnsureEmailIsVerified::class,
+        'bindings' => \Illuminate\Routing\Middleware\SubstituteBindings::class,
+        'createPassword' => \App\Http\Middleware\CheckCreatePassword::class,
+        'checkVerifyNewEmail' => \App\Http\Middleware\CheckVerifyNewEmail::class,
+        'permission' => \App\Http\Middleware\CheckPermission::class,
+        'checkIsActive' => \App\Http\Middleware\CheckIsActive::class,
     ];
 }
Index: app/Http/Middleware/Authenticate.php
===================================================================
--- app/Http/Middleware/Authenticate.php	(revision 2fc88eca8e50b236d520d00f243f96eef97ae67f)
+++ app/Http/Middleware/Authenticate.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
@@ -16,5 +16,5 @@
     {
         if (! $request->expectsJson()) {
-            return route('login');
+            return route('auth.loginShow');
         }
     }
Index: app/Http/Middleware/CheckCreatePassword.php
===================================================================
--- app/Http/Middleware/CheckCreatePassword.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
+++ app/Http/Middleware/CheckCreatePassword.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use App\Models\User;
+use Illuminate\Support\Carbon;
+
+class CheckCreatePassword
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  \Closure  $next
+     * @return mixed
+     */
+    public function handle($request, Closure $next)
+    {
+        $id = $request->route("id");
+        $token = $request->route("token");
+
+        $user = User::findOrFail($id);
+
+        if($user->is_active) {
+            return redirect()->route("auth.loginShow");
+        }
+
+        if(!$user->is_forgot_password) {
+            if(Carbon::now()->greaterThan($user->created_at->addMinutes(10))) {
+                return redirect()->route("auth.loginShow");
+            }
+        }
+
+        return $next($request);
+    }
+}
Index: app/Http/Middleware/CheckForMaintenanceMode.php
===================================================================
--- app/Http/Middleware/CheckForMaintenanceMode.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
+++ app/Http/Middleware/CheckForMaintenanceMode.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
@@ -0,0 +1,17 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode as Middleware;
+
+class CheckForMaintenanceMode extends Middleware
+{
+    /**
+     * The URIs that should be reachable while maintenance mode is enabled.
+     *
+     * @var array
+     */
+    protected $except = [
+        //
+    ];
+}
Index: app/Http/Middleware/CheckIsActive.php
===================================================================
--- app/Http/Middleware/CheckIsActive.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
+++ app/Http/Middleware/CheckIsActive.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+
+class CheckIsActive
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  \Closure  $next
+     * @return mixed
+     */
+    public function handle($request, Closure $next)
+    {
+        if(!auth()->user()->is_active) {
+
+            $user = auth()->user();
+            $user->is_online = false;
+            $user->save();
+
+            auth()->logout();
+
+            return redirect()->route("auth.loginShow");
+        }
+
+        return $next($request);
+    }
+}
Index: app/Http/Middleware/CheckPermission.php
===================================================================
--- app/Http/Middleware/CheckPermission.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
+++ app/Http/Middleware/CheckPermission.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+
+class CheckPermission
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  \Closure  $next
+     * @return mixed
+     */
+    public function handle($request, Closure $next, $permission)
+    {
+        $user = auth()->user();
+
+        if($user->hasPermission($permission)) {
+            return $next($request);
+        }
+
+        return abort(403);
+    }
+}
Index: app/Http/Middleware/CheckVerifyNewEmail.php
===================================================================
--- app/Http/Middleware/CheckVerifyNewEmail.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
+++ app/Http/Middleware/CheckVerifyNewEmail.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use App\Models\User;
+
+class CheckVerifyNewEmail
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  \Closure  $next
+     * @return mixed
+     */
+    public function handle($request, Closure $next)
+    {
+        $id = $request->route("id");
+        $token = $request->route("token");
+
+        $user = User::findOrFail($id);
+
+        if($user->is_active) {
+            return redirect()->route("auth.loginShow");
+        }
+
+        return $next($request);
+    }
+}
Index: app/Http/Middleware/TrimStrings.php
===================================================================
--- app/Http/Middleware/TrimStrings.php	(revision 2fc88eca8e50b236d520d00f243f96eef97ae67f)
+++ app/Http/Middleware/TrimStrings.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
@@ -13,5 +13,4 @@
      */
     protected $except = [
-        'current_password',
         'password',
         'password_confirmation',
Index: app/Http/Middleware/TrustHosts.php
===================================================================
--- app/Http/Middleware/TrustHosts.php	(revision 2fc88eca8e50b236d520d00f243f96eef97ae67f)
+++ app/Http/Middleware/TrustHosts.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
@@ -4,4 +4,5 @@
 
 use Illuminate\Http\Middleware\TrustHosts as Middleware;
+use Illuminate\Http\Request;
 
 class TrustHosts extends Middleware
Index: app/Http/Middleware/VerifyCsrfToken.php
===================================================================
--- app/Http/Middleware/VerifyCsrfToken.php	(revision 2fc88eca8e50b236d520d00f243f96eef97ae67f)
+++ app/Http/Middleware/VerifyCsrfToken.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
@@ -8,4 +8,11 @@
 {
     /**
+     * Indicates whether the XSRF-TOKEN cookie should be set on the response.
+     *
+     * @var bool
+     */
+    protected $addHttpCookie = true;
+
+    /**
      * The URIs that should be excluded from CSRF verification.
      *
Index: app/Http/Requests/Auth/CreatePasswordRequest.php
===================================================================
--- app/Http/Requests/Auth/CreatePasswordRequest.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
+++ app/Http/Requests/Auth/CreatePasswordRequest.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Http\Requests\Auth;
+
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class CreatePasswordRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     *
+     * @return bool
+     */
+    public function authorize()
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array
+     */
+    public function rules()
+    {
+        $that = $this;
+
+        return [
+            "password" => "required|string|confirmed|min:8",
+            "security_code" => [
+                "required",
+                "integer",
+                Rule::exists("users")->where(function ($query) use ($that) {
+                    $query->where("id", $that->route("id"));
+                }),
+            ]
+        ];
+    }
+}
Index: app/Http/Requests/Auth/ForgotPasswordRequest.php
===================================================================
--- app/Http/Requests/Auth/ForgotPasswordRequest.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
+++ app/Http/Requests/Auth/ForgotPasswordRequest.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Http\Requests\Auth;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class ForgotPasswordRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     *
+     * @return bool
+     */
+    public function authorize()
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array
+     */
+    public function rules()
+    {
+        return [
+            "email" => "required|email|exists:users"
+        ];
+    }
+}
Index: app/Http/Requests/Auth/LoginRequest.php
===================================================================
--- app/Http/Requests/Auth/LoginRequest.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
+++ app/Http/Requests/Auth/LoginRequest.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Http\Requests\Auth;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class LoginRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     *
+     * @return bool
+     */
+    public function authorize()
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array
+     */
+    public function rules()
+    {
+        return [
+            "username" => "required|exists:users,username"
+        ];
+    }
+}
Index: app/Http/Requests/Auth/VerifyNewEmailRequest.php
===================================================================
--- app/Http/Requests/Auth/VerifyNewEmailRequest.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
+++ app/Http/Requests/Auth/VerifyNewEmailRequest.php	(revision 582789f8fd3b5f9520ed36b7f2feb0828d4a43af)
@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Http\Requests\Auth;
+
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class VerifyNewEmailRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     *
+     * @return bool
+     */
+    public function authorize()
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array
+     */
+    public function rules()
+    {
+        $that = $this;
+
+        return [
+            "security_code" => [
+                "required",
+                "integer",
+                Rule::exists("users")->where(function ($query) use ($that) {
+                    $query->where("id", $that->route("id"));
+                }),
+            ]
+        ];
+    }
+}
