src/Controller/ResetPasswordController.php line 46

Open in your IDE?
  1. <?php
  3. namespace App\Controller;
  5. use App\Entity\User;
  6. use App\Form\ChangePasswordFormType;
  7. use App\Form\ResetPasswordRequestFormType;
  8. use App\Service\PasswordResetService;
  9. use Doctrine\ORM\EntityManagerInterface;
  10. use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
  11. use Symfony\Component\HttpFoundation\Request;
  12. use Symfony\Component\HttpFoundation\Response;
  13. use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
  14. use Symfony\Component\Routing\Annotation\Route;
  15. use SymfonyCasts\Bundle\ResetPassword\Controller\ResetPasswordControllerTrait;
  16. use SymfonyCasts\Bundle\ResetPassword\Exception\ResetPasswordExceptionInterface;
  17. use SymfonyCasts\Bundle\ResetPassword\ResetPasswordHelperInterface;
  19. /**
  20.  * @Route("/reset-password")
  21.  */
  22. class ResetPasswordController extends AbstractController
  23. {
  24.     use ResetPasswordControllerTrait;
  26.     private PasswordResetService $passwordResetService;
  27.     private ResetPasswordHelperInterface $resetPasswordHelper;
  28.     private EntityManagerInterface $entityManager;
  30.     public function __construct(
  31.         PasswordResetService $passwordResetService,
  32.         ResetPasswordHelperInterface $resetPasswordHelper,
  33.         EntityManagerInterface $entityManager
  34.     )
  35.     {
  36.         $this->passwordResetService = $passwordResetService;
  37.         $this->resetPasswordHelper = $resetPasswordHelper;
  38.         $this->entityManager = $entityManager;
  39.     }
  41.     /**
  42.      * Display & process form to request a password reset.
  43.      *
  44.      * @Route("", name="app_forgot_password_request")
  45.      */
  46.     public function request(Request $request): Response
  47.     {
  48.         $form = $this->createForm(ResetPasswordRequestFormType::class);
  49.         $form->handleRequest($request);
  51.         if ($form->isSubmitted() && $form->isValid()) {
  52.             $token = $this->passwordResetService->sendResetEmail($form->get('email')->getData());
  53.             $this->setTokenObjectInSession($token);
  54.             return $this->redirectToRoute('app_check_email');
  55.         }
  57.         return $this->render('reset_password/request.html.twig', [
  58.             'requestForm' => $form->createView(),
  59.         ]);
  60.     }
  62.     /**
  63.      * Confirmation page after a user has requested a password reset.
  64.      *
  65.      * @Route("/check-email", name="app_check_email")
  66.      */
  67.     public function checkEmail(): Response
  68.     {
  69.         // Generate a fake token if the user does not exist or someone hit this page directly.
  70.         // This prevents exposing whether or not a user was found with the given email address or not
  71.         if (null === ($resetToken = $this->getTokenObjectFromSession())) {
  72.             $resetToken = $this->resetPasswordHelper->generateFakeResetToken();
  73.         }
  75.         return $this->render('reset_password/check_email.html.twig', [
  76.             'resetToken' => $resetToken,
  77.         ]);
  78.     }
  80.     /**
  81.      * Validates and process the reset URL that the user clicked in their email.
  82.      *
  83.      * @Route("/reset/{token}", name="app_reset_password")
  84.      */
  85.     public function reset(Request $request, UserPasswordHasherInterface $userPasswordHasher, string $token = null): Response
  86.     {
  87.         if ($token) {
  88.             // We store the token in session and remove it from the URL, to avoid the URL being
  89.             // loaded in a browser and potentially leaking the token to 3rd party JavaScript.
  90.             $this->storeTokenInSession($token);
  91.             return $this->redirectToRoute('app_reset_password');
  92.         }
  94.         $token = $this->getTokenFromSession();
  95.         if (null === $token) {
  96.             throw $this->createNotFoundException('No reset password token found in the URL or in the session.');
  97.         }
  99.         try {
  100.             /** @var User $user */
  101.             $user = $this->resetPasswordHelper->validateTokenAndFetchUser($token);
  102.         } catch (ResetPasswordExceptionInterface $e) {
  103.             $this->addFlash('reset_password_error', sprintf(
  104.                 '%s - %s',
  105.                 ResetPasswordExceptionInterface::MESSAGE_PROBLEM_VALIDATE,
  106.                 $e->getReason()
  107.             ));
  109.             return $this->redirectToRoute('app_forgot_password_request');
  110.         }
  112.         // The token is valid; allow the user to change their password.
  113.         $form = $this->createForm(ChangePasswordFormType::class);
  114.         $form->handleRequest($request);
  116.         if ($form->isSubmitted() && $form->isValid()) {
  117.             // A password reset token should be used only once, remove it.
  118.             $this->resetPasswordHelper->removeResetRequest($token);
  120.             // Hash the plain password, and set it.
  121.             $encodedPassword = $userPasswordHasher->hashPassword(
  122.                 $user,
  123.                 $form->get('plainPassword')->getData()
  124.             );
  126.             $user->setPassword($encodedPassword);
  127.             $this->entityManager->flush();
  129.             // The session is cleaned up after the password has been changed.
  130.             $this->cleanSessionAfterReset();
  132.             return $this->redirectToRoute('main');
  133.         }
  135.         return $this->render('reset_password/reset.html.twig', [
  136.             'resetForm' => $form->createView(),
  137.         ]);
  138.     }
  139. }