refactored Password recovery into Security
This commit is contained in:
parent
e7031c5e63
commit
f83d12443e
|
|
@ -2,31 +2,44 @@
|
|||
|
||||
namespace App\Controller;
|
||||
|
||||
use App\Form\LoginFormType;
|
||||
use App\Entity\User;
|
||||
use App\Form\ChangePasswordFormType;
|
||||
use App\Form\RegistrationFormType;
|
||||
use App\Form\ResetPasswordRequestFormType;
|
||||
use App\Repository\UserRepository;
|
||||
use App\Security\EmailVerifier;
|
||||
use Doctrine\ORM\EntityManagerInterface;
|
||||
use Exception;
|
||||
use Symfony\Bridge\Twig\Mime\TemplatedEmail;
|
||||
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
|
||||
use Symfony\Component\HttpFoundation\RedirectResponse;
|
||||
use Symfony\Component\HttpFoundation\Request;
|
||||
use Symfony\Component\HttpFoundation\Response;
|
||||
use Symfony\Component\Mailer\Exception\TransportExceptionInterface;
|
||||
use Symfony\Component\Mailer\MailerInterface;
|
||||
use Symfony\Component\Mime\Address;
|
||||
use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
|
||||
use Symfony\Component\Routing\Annotation\Route;
|
||||
use Symfony\Component\Security\Http\Authentication\AuthenticationUtils;
|
||||
use Symfony\Contracts\Translation\TranslatorInterface;
|
||||
use SymfonyCasts\Bundle\ResetPassword\Controller\ResetPasswordControllerTrait;
|
||||
use SymfonyCasts\Bundle\ResetPassword\Exception\ResetPasswordExceptionInterface;
|
||||
use SymfonyCasts\Bundle\ResetPassword\ResetPasswordHelperInterface;
|
||||
use SymfonyCasts\Bundle\VerifyEmail\Exception\VerifyEmailExceptionInterface;
|
||||
|
||||
class SecurityController extends AbstractController
|
||||
{
|
||||
use ResetPasswordControllerTrait;
|
||||
|
||||
public function __construct(private readonly EmailVerifier $emailVerifier)
|
||||
public function __construct(private readonly EmailVerifier $emailVerifier,
|
||||
private readonly ResetPasswordHelperInterface $resetPasswordHelper,
|
||||
private readonly EntityManagerInterface $entityManager
|
||||
)
|
||||
{
|
||||
// empty body
|
||||
}
|
||||
|
||||
#[Route(path: '/login', name: 'app_login')]
|
||||
#[Route(path: '/security/login', name: 'security_login')]
|
||||
public function index(AuthenticationUtils $authenticationUtils): Response
|
||||
{
|
||||
// get the login error if there is one
|
||||
|
|
@ -43,8 +56,16 @@ class SecurityController extends AbstractController
|
|||
]);
|
||||
}
|
||||
|
||||
/**
|
||||
* @throws Exception
|
||||
*/
|
||||
#[Route(path: '/security/logout', name: 'security_logout')]
|
||||
public function logout(): never
|
||||
{
|
||||
throw new Exception(message: 'Logout should never be reached.');
|
||||
}
|
||||
|
||||
#[Route(path: '/register', name: 'app_register')]
|
||||
#[Route(path: '/security/register', name: 'security_register')]
|
||||
public function register(Request $request, UserPasswordHasherInterface $userPasswordHasher, EntityManagerInterface $entityManager): Response
|
||||
{
|
||||
$form = $this->createForm(type: RegistrationFormType::class);
|
||||
|
|
@ -67,15 +88,15 @@ class SecurityController extends AbstractController
|
|||
$entityManager->flush();
|
||||
|
||||
// generate a signed url and email it to the user
|
||||
$this->emailVerifier->sendEmailConfirmation(verifyEmailRouteName: 'app_verify_email', user: $user,
|
||||
$this->emailVerifier->sendEmailConfirmation(verifyEmailRouteName: 'security_verify_email', user: $user,
|
||||
email: (new TemplatedEmail())
|
||||
->from(new Address(address: 'info@24unix.net', name: '24unix.net'))
|
||||
->to($user->getEmail())
|
||||
->subject(subject: 'Please Confirm your Email')
|
||||
->htmlTemplate(template: '@default/security/mail/registration.html.twig')
|
||||
->context(context: [
|
||||
'username' => $user->getUsername()
|
||||
])
|
||||
->context(context: [
|
||||
'username' => $user->getUsername()
|
||||
])
|
||||
);
|
||||
|
||||
return $this->render(view: '@default/security/registration_finished.html.twig');
|
||||
|
|
@ -86,7 +107,7 @@ class SecurityController extends AbstractController
|
|||
]);
|
||||
}
|
||||
|
||||
#[Route(path: '/verify/email', name: 'app_verify_email')]
|
||||
#[Route(path: '/security/verify/email', name: 'security_verify_email')]
|
||||
public function verifyUserEmail(Request $request, TranslatorInterface $translator, UserRepository $userRepository): Response
|
||||
{
|
||||
$id = $request->get(key: 'id');
|
||||
|
|
@ -115,4 +136,152 @@ class SecurityController extends AbstractController
|
|||
return $this->redirectToRoute(route: 'app_main');
|
||||
}
|
||||
|
||||
/**
|
||||
* Display & process form to request a password reset.
|
||||
*/
|
||||
#[Route(path: '/security/forgot/password', name: 'security_forgot_password')]
|
||||
public function request(Request $request, MailerInterface $mailer): Response
|
||||
{
|
||||
$form = $this->createForm(type: ResetPasswordRequestFormType::class);
|
||||
$form->handleRequest(request: $request);
|
||||
|
||||
if ($form->isSubmitted() && $form->isValid()) {
|
||||
return $this->processSendingPasswordResetEmail(
|
||||
formData: $form->get(name: 'account')->getData(),
|
||||
mailer: $mailer
|
||||
);
|
||||
}
|
||||
|
||||
return $this->render(view: '@default/security/forgot_password.html.twig', parameters: [
|
||||
'requestForm' => $form->createView(),
|
||||
]);
|
||||
}
|
||||
|
||||
/**
|
||||
* Confirmation page after a user has requested a password reset.
|
||||
*/
|
||||
#[Route(path: '/security/recovery/mail/sent', name: 'security_recovery_mail_sent')]
|
||||
public function checkEmail(): Response
|
||||
{
|
||||
// Generate a fake token if the user does not exist or someone hit this page directly.
|
||||
// This prevents exposing whether a user was found with the given email address or username or not
|
||||
if (null === ($resetToken = $this->getTokenObjectFromSession())) {
|
||||
$resetToken = $this->resetPasswordHelper->generateFakeResetToken();
|
||||
}
|
||||
|
||||
return $this->render(view: '@default/security/recovery_mail_sent.html.twig', parameters: [
|
||||
'resetToken' => $resetToken,
|
||||
]);
|
||||
}
|
||||
|
||||
/**
|
||||
* Validates and process the reset URL that the user clicked in their email.
|
||||
*/
|
||||
#[Route(path: '/security/recovery/reset/{token}', name: 'security_recovery_reset')]
|
||||
public function reset(Request $request, UserPasswordHasherInterface $passwordHasher, TranslatorInterface $translator, string $token = null): Response
|
||||
{
|
||||
if ($token) {
|
||||
// We store the token in session and remove it from the URL, to avoid the URL being
|
||||
// loaded in a browser and potentially leaking the token to 3rd party JavaScript.
|
||||
$this->storeTokenInSession(token: $token);
|
||||
|
||||
return $this->redirectToRoute(route: 'security_recovery_reset');
|
||||
}
|
||||
|
||||
$token = $this->getTokenFromSession();
|
||||
if (null === $token) {
|
||||
throw $this->createNotFoundException(message: 'No reset password token found in the URL or in the session.');
|
||||
}
|
||||
|
||||
try {
|
||||
$user = $this->resetPasswordHelper->validateTokenAndFetchUser(fullToken: $token);
|
||||
} catch (ResetPasswordExceptionInterface $e) {
|
||||
$this->addFlash(type: 'reset_password_error', message: sprintf(
|
||||
'%s - %s',
|
||||
$translator->trans(id: ResetPasswordExceptionInterface::MESSAGE_PROBLEM_VALIDATE, parameters: [], domain: 'ResetPasswordBundle'),
|
||||
$translator->trans(id: $e->getReason(), parameters: [], domain: 'ResetPasswordBundle')
|
||||
));
|
||||
|
||||
return $this->redirectToRoute(route: 'app_forgot_password_request');
|
||||
}
|
||||
|
||||
// The token is valid; allow the user to change their password.
|
||||
$form = $this->createForm(type: ChangePasswordFormType::class);
|
||||
$form->handleRequest(request: $request);
|
||||
|
||||
if ($form->isSubmitted() && $form->isValid()) {
|
||||
// A password reset token should be used only once, remove it.
|
||||
$this->resetPasswordHelper->removeResetRequest(fullToken: $token);
|
||||
|
||||
// Encode(hash) the plain password, and set it.
|
||||
$encodedPassword = $passwordHasher->hashPassword(
|
||||
user: $user,
|
||||
plainPassword: $form->get(name: 'plainPassword')->getData()
|
||||
);
|
||||
|
||||
$user->setPassword($encodedPassword);
|
||||
$this->entityManager->flush();
|
||||
|
||||
// The session is cleaned up after the password has been changed.
|
||||
$this->cleanSessionAfterReset();
|
||||
|
||||
$this->addFlash(type: 'success', message: 'Your password has been changed.');
|
||||
|
||||
return $this->redirectToRoute(route: 'app_main');
|
||||
}
|
||||
|
||||
return $this->render(view: '@default/security/reset_password.html.twig', parameters: [
|
||||
'resetForm' => $form->createView(),
|
||||
]);
|
||||
}
|
||||
|
||||
private function processSendingPasswordResetEmail(string $formData, MailerInterface $mailer): RedirectResponse
|
||||
{
|
||||
$user = $this->entityManager->getRepository(entityName: User::class)->findOneBy(criteria: [
|
||||
'email' => $formData,
|
||||
]);
|
||||
|
||||
if (!$user) {
|
||||
$user = $this->entityManager->getRepository(entityName: User::class)->findOneBy(criteria: [
|
||||
'username' => $formData,
|
||||
]);
|
||||
}
|
||||
|
||||
// Do not reveal whether a user account was found or not.
|
||||
// if (!$user) {
|
||||
// return $this->redirectToRoute(route: 'app_check_email');
|
||||
// }
|
||||
|
||||
try {
|
||||
$resetToken = $this->resetPasswordHelper->generateResetToken(user: $user);
|
||||
} catch (ResetPasswordExceptionInterface $e) {
|
||||
$this->addFlash(type: 'reset_password_error', message: sprintf(
|
||||
'%s - %s',
|
||||
ResetPasswordExceptionInterface::MESSAGE_PROBLEM_HANDLE,
|
||||
$e->getReason()
|
||||
));
|
||||
|
||||
return $this->redirectToRoute(route: 'security_forgot_password');
|
||||
}
|
||||
|
||||
$email = (new TemplatedEmail())
|
||||
->from(new Address(address: 'tracer@24unix.net', name: '24unix.net'))
|
||||
->to($user->getEmail())
|
||||
->subject(subject: 'Your password reset request')
|
||||
->htmlTemplate(template: '@default/security/mail/recovery.html.twig')
|
||||
->context(context: [
|
||||
'resetToken' => $resetToken,
|
||||
]);
|
||||
|
||||
try {
|
||||
$mailer->send(message: $email);
|
||||
} catch (TransportExceptionInterface $e) {
|
||||
$this->addFlash(type: 'error', message: $e->getMessage());
|
||||
}
|
||||
|
||||
// Store the token object in session for retrieval in check-email route.
|
||||
$this->setTokenObjectInSession(token: $resetToken);
|
||||
|
||||
return $this->redirectToRoute(route: 'security_recovery_mail_sent');
|
||||
}
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in New Issue