public function UserController::resetPassLogin in Drupal 9

Same name and namespace in other branches

1. 8 core/modules/user/src/Controller/UserController.php \Drupal\user\Controller\UserController::resetPassLogin()

Validates user, hash, and timestamp; logs the user in if correct.

Parameters

int $uid: User ID of the user requesting reset.

int $timestamp: The current timestamp.

string $hash: Login link hash.

\Symfony\Component\HttpFoundation\Request $request: The request.

Return value

\Symfony\Component\HttpFoundation\RedirectResponse Returns a redirect to the user edit form if the information is correct. If the information is incorrect redirects to 'user.pass' route with a message for the user.

Throws

\Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException If $uid is for a blocked user or invalid user ID.

1 string reference to 'UserController::resetPassLogin'

user.routing.yml in core/modules/user/user.routing.yml

core/modules/user/user.routing.yml

File

core/modules/user/src/Controller/UserController.php, line 224

Class

UserController

Controller routines for user routes.

Namespace

Drupal\user\Controller

Code

public function resetPassLogin($uid, $timestamp, $hash, Request $request) {

  // The current user is not logged in, so check the parameters.
  $current = REQUEST_TIME;

  /** @var \Drupal\user\UserInterface $user */
  $user = $this->userStorage
    ->load($uid);

  // Verify that the user exists and is active.
  if ($user === NULL || !$user
    ->isActive()) {

    // Blocked or invalid user ID, so deny access. The parameters will be in
    // the watchdog's URL for the administrator to check.
    throw new AccessDeniedHttpException();
  }

  // Time out, in seconds, until login URL expires.
  $timeout = $this
    ->config('user.settings')
    ->get('password_reset_timeout');

  // No time out for first time login.
  if ($user
    ->getLastLoginTime() && $current - $timestamp > $timeout) {
    $this
      ->messenger()
      ->addError($this
      ->t('You have tried to use a one-time login link that has expired. Please request a new one using the form below.'));
    return $this
      ->redirect('user.pass');
  }
  elseif ($user
    ->isAuthenticated() && $timestamp >= $user
    ->getLastLoginTime() && $timestamp <= $current && hash_equals($hash, user_pass_rehash($user, $timestamp))) {
    user_login_finalize($user);
    $this->logger
      ->notice('User %name used one-time login link at time %timestamp.', [
      '%name' => $user
        ->getDisplayName(),
      '%timestamp' => $timestamp,
    ]);
    $this
      ->messenger()
      ->addStatus($this
      ->t('You have just used your one-time login link. It is no longer necessary to use this link to log in. Please change your password.'));

    // Let the user's password be changed without the current password
    // check.
    $token = Crypt::randomBytesBase64(55);
    $request
      ->getSession()
      ->set('pass_reset_' . $user
      ->id(), $token);

    // Clear any flood events for this user.
    $this->flood
      ->clear('user.password_request_user', $uid);
    return $this
      ->redirect('entity.user.edit_form', [
      'user' => $user
        ->id(),
    ], [
      'query' => [
        'pass-reset-token' => $token,
      ],
      'absolute' => TRUE,
    ]);
  }
  $this
    ->messenger()
    ->addError($this
    ->t('You have tried to use a one-time login link that has either been used or is no longer valid. Please request a new one using the form below.'));
  return $this
    ->redirect('user.pass');
}