src/Controller/ResetPasswordController.php line 52

Open in your IDE?
  1. <?php
  3. declare(strict_types=1);
  5. /*
  6.  * ImmoBay - BAUR Immobilien
  7.  *
  8.  * @copyright  Copyright (c) 2008-2022, 47GradNord - Agentur für Internetlösungen
  9.  * @author     47GradNord - Agentur für Internetlösungen <info@47gradnord.de>
  10.  */
  12. namespace App\Controller;
  14. use App\Entity\User;
  15. use App\Form\ChangePasswordFormType;
  16. use App\Form\ResetPasswordRequestFormType;
  17. use Doctrine\ORM\EntityManagerInterface;
  18. use http\Exception;
  19. use Symfony\Bridge\Twig\Mime\TemplatedEmail;
  20. use Symfony\Component\HttpFoundation\RedirectResponse;
  21. use Symfony\Component\HttpFoundation\Request;
  22. use Symfony\Component\HttpFoundation\Response;
  23. use Symfony\Component\Mailer\MailerInterface;
  24. use Symfony\Component\Mime\Address;
  25. use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
  26. use Symfony\Component\Routing\Annotation\Route;
  27. use SymfonyCasts\Bundle\ResetPassword\Controller\ResetPasswordControllerTrait;
  28. use SymfonyCasts\Bundle\ResetPassword\Exception\ResetPasswordExceptionInterface;
  29. use SymfonyCasts\Bundle\ResetPassword\ResetPasswordHelperInterface;
  31. /**
  32.  * @Route("/reset-password")
  33.  */
  34. class ResetPasswordController extends AbstractAppController
  35. {
  36.     use ResetPasswordControllerTrait;
  38.     private $resetPasswordHelper;
  39.     private $entityManager;
  41.     public function __construct(ResetPasswordHelperInterface $resetPasswordHelper, EntityManagerInterface $entityManager)
  42.     {
  43.         $this->resetPasswordHelper = $resetPasswordHelper;
  44.         $this->entityManager = $entityManager;
  45.     }
  47.     /**
  48.      * Display & process form to request a password reset.
  49.      *
  50.      * @Route("", name="app_forgot_password_request")
  51.      */
  52.     public function request(Request $request, MailerInterface $mailer): Response
  53.     {
  54.         $form = $this->createForm(ResetPasswordRequestFormType::class);
  55.         $form->handleRequest($request);
  57.         if ($form->isSubmitted() && $form->isValid()) {
  58.             return $this->processSendingPasswordResetEmail(
  59.                 $form->get('email')->getData(),
  60.                 $mailer
  61.             );
  62.         }
  64.         return $this->render('reset_password/request.html.twig', [
  65.             'requestForm' => $form->createView(),
  66.         ]);
  67.     }
  69.     /**
  70.      * Confirmation page after a user has requested a password reset.
  71.      *
  72.      * @Route("/check-email", name="app_check_email")
  73.      */
  74.     public function checkEmail(): Response
  75.     {
  76.         // Generate a fake token if the user does not exist or someone hit this page directly.
  77.         // This prevents exposing whether or not a user was found with the given email address or not
  78.         if (null === ($resetToken = $this->getTokenObjectFromSession())) {
  79.             $resetToken = $this->resetPasswordHelper->generateFakeResetToken();
  80.         }
  82.         return $this->render('reset_password/check_email.html.twig', [
  83.             'resetToken' => $resetToken,
  84.         ]);
  85.     }
  87.     /**
  88.      * Validates and process the reset URL that the user clicked in their email.
  89.      *
  90.      * @Route("/reset/{token}", name="app_reset_password")
  91.      */
  92.     public function reset(Request $request, UserPasswordHasherInterface $userPasswordHasher, string $token = null): Response
  93.     {
  94.         if ($token) {
  95.             // We store the token in session and remove it from the URL, to avoid the URL being
  96.             // loaded in a browser and potentially leaking the token to 3rd party JavaScript.
  97.             $this->storeTokenInSession($token);
  99.             return $this->redirectToRoute('app_reset_password');
  100.         }
  102.         $token = $this->getTokenFromSession();
  103.         if (null === $token) {
  104.             throw $this->createNotFoundException('No reset password token found in the URL or in the session.');
  105.         }
  107.         try {
  108.             $user = $this->resetPasswordHelper->validateTokenAndFetchUser($token);
  109.         } catch (ResetPasswordExceptionInterface $e) {
  110.             $this->addFlash('reset_password_error', sprintf(
  111.                 'There was a problem validating your reset request - %s',
  112.                 $e->getReason()
  113.             ));
  115.             return $this->redirectToRoute('app_forgot_password_request');
  116.         }
  118.         // The token is valid; allow the user to change their password.
  119.         $form = $this->createForm(ChangePasswordFormType::class);
  120.         $form->handleRequest($request);
  122.         if ($form->isSubmitted() && $form->isValid()) {
  123.             // A password reset token should be used only once, remove it.
  124.             $this->resetPasswordHelper->removeResetRequest($token);
  126.             // Encode(hash) the plain password, and set it.
  127.             $encodedPassword = $userPasswordHasher->hashPassword(
  128.                 $user,
  129.                 $form->get('plainPassword')->getData()
  130.             );
  132.             $user->setPassword($encodedPassword);
  133.             $this->entityManager->flush();
  135.             // The session is cleaned up after the password has been changed.
  136.             $this->cleanSessionAfterReset();
  138.             return $this->redirectToRoute('app_index');
  139.         }
  141.         return $this->render('reset_password/reset.html.twig', [
  142.             'resetForm' => $form->createView(),
  143.         ]);
  144.     }
  146.     /**
  147.      * @Route("/changepassword-forced", name="app_changepassword_forced")
  148.      */
  149.     public function changePasswordForced(Request $request, UserPasswordHasherInterface $userPasswordHasher): Response
  150.     {
  151.         /** @var User $user */
  152.         $user = $this->getUser();
  154.         if (null === $user) {
  155.             throw $this->createAccessDeniedException('Diese Seite ist nicht aufrufbar');
  156.         }
  158.         $form = $this->createForm(ChangePasswordFormType::class, $user);
  159.         $form->handleRequest($request);
  161.         if ($form->isSubmitted() && $form->isValid()) {
  162.             try {
  163.                 $changePassword = $request->request->get('change_password_form');
  164.                 $password = $changePassword['plainPassword']['first'];
  166.                 $pass = $userPasswordHasher->hashPassword($user, $password);
  168.                 $user->setPassword($pass);
  169.                 // $user->setForceChangePassword(false);
  170.                 $this->entityManager->persist($user);
  171.                 $this->entityManager->flush();
  172.                 $this->addFlash('success', 'Password erfolgreich geändert!');
  173.             } catch (Exception $e) {
  174.                 $this->addFlash('danger', 'Fehler, bitte versuchen Sie es erneut.');
  176.                 return $this->redirectToRoute('app_changepassword_forced');
  177.             }
  179.             return $this->redirectToRoute('app_logout');
  180.         }
  182.         return $this->render('reset_password/reset.html.twig', [
  183.             'resetForm' => $form->createView(),
  184.             'user' => $this->getUser(),
  185.         ]);
  186.     }
  188.     private function processSendingPasswordResetEmail(string $emailFormData, MailerInterface $mailer): RedirectResponse
  189.     {
  190.         $user = $this->entityManager->getRepository(User::class)->findOneBy([
  191.             'email' => $emailFormData,
  192.         ]);
  194.         // Do not reveal whether a user account was found or not.
  195.         if (!$user) {
  196.             return $this->redirectToRoute('app_check_email');
  197.         }
  199.         try {
  200.             $resetToken = $this->resetPasswordHelper->generateResetToken($user);
  201.         } catch (ResetPasswordExceptionInterface $e) {
  202.             // If you want to tell the user why a reset email was not sent, uncomment
  203.             // the lines below and change the redirect to 'app_forgot_password_request'.
  204.             // Caution: This may reveal if a user is registered or not.
  205.             //
  206.             // $this->addFlash('reset_password_error', sprintf(
  207.             //     'There was a problem handling your password reset request - %s',
  208.             //     $e->getReason()
  209.             // ));
  211.             return $this->redirectToRoute('app_check_email');
  212.         }
  214.         $email = (new TemplatedEmail())
  215.             ->from(new Address('no-reply@baur-immobilien.de', 'Bieter-Plattform | BAUR-Immobilien'))
  216.             ->to($user->getEmail())
  217.             ->subject('Ihre Anfrage: Passwort zurücksetzen')
  218.             ->htmlTemplate('reset_password/email.html.twig')
  219.             ->context([
  220.                 'resetToken' => $resetToken,
  221.             ]);
  223.         $mailer->send($email);
  225.         // Store the token object in session for retrieval in check-email route.
  226.         $this->setTokenObjectInSession($resetToken);
  228.         return $this->redirectToRoute('app_check_email');
  229.     }
  230. }