src/Controller/Backend/ResetPasswordController.php
/**
     * Validates and process the reset URL that the user clicked in their email.
     *
     * @Route("/reset/{token}", name="bolt_reset_password")
     */
Validates and process the reset URL that the user clicked in their email.
Validates and process the reset URL that the user clicked in their email .
public function reset(Request $request, UserPasswordHasherInterface $passwordHasher, ?string $token = null): Response
    {
        if ($token) {
            $this->storeTokenInSession($token);
            return $this->redirectToRoute('bolt_reset_password');
        }
        $token = $this->getTokenFromSession();
        if ($token === null) {
            throw $this->createNotFoundException($this->translator->trans('reset_password.no_token'));
        }
        try {
            $user = $this->resetPasswordHelper->validateTokenAndFetchUser($token);
        } catch (ResetPasswordExceptionInterface $e) {
            $this->addFlash('reset_password_error', sprintf(
                'There was a problem validating your reset request - %s',
                $e->getReason()
            ));
            return $this->redirectToRoute('bolt_forgot_password_request');
        }
        $form = $this->createForm(ChangePasswordFormType::class);
        $form->handleRequest($request);
        if ($form->isSubmitted() && $form->isValid()) {
            $this->resetPasswordHelper->removeResetRequest($token);
            $encodedPassword = $passwordHasher->hashPassword(
                $user,
                $form->get('plainPassword')->getData()
            );
            $user->setPassword($encodedPassword);
            $this->getDoctrine()->getManager()->flush();
            $this->cleanSessionAfterReset();
            $this->addFlash('reset_password_success', $this->translator->trans('reset_password.reset_successful'));
            return $this->redirectToRoute('bolt_login');
        }
        return $this->render('reset_password/reset.html.twig', [
            'resetForm' => $form->createView(),
        ]);
    }
public function reset ( Request $ request , UserPasswordHasherInterface $ passwordHasher , ? string $ token = null ) : Response { if ( $ token ) { $ this -> storeTokenInSession ( $ token ) ; return $ this -> redirectToRoute ( 'bolt_reset_password' ) ; } $ token = $ this -> getTokenFromSession ( ) ; if ( $ token === null ) { throw $ this -> createNotFoundException ( $ this -> translator -> trans ( 'reset_password.no_token' ) ) ; } try { $ user = $ this -> resetPasswordHelper -> validateTokenAndFetchUser ( $ token ) ; } catch ( ResetPasswordExceptionInterface $ e ) { $ this -> addFlash ( 'reset_password_error' , sprintf ( 'There was a problem validating your reset request - %s' , $ e -> getReason ( ) ) ) ; return $ this -> redirectToRoute ( 'bolt_forgot_password_request' ) ; } $ form = $ this -> createForm ( ChangePasswordFormType :: class ) ; $ form -> handleRequest ( $ request ) ; if ( $ form -> isSubmitted ( ) && $ form -> isValid ( ) ) { $ this -> resetPasswordHelper -> removeResetRequest ( $ token ) ; $ encodedPassword = $ passwordHasher -> hashPassword ( $ user , $ form -> get ( 'plainPassword' ) -> getData ( ) ) ; $ user -> setPassword ( $ encodedPassword ) ; $ this -> getDoctrine ( ) -> getManager ( ) -> flush ( ) ; $ this -> cleanSessionAfterReset ( ) ; $ this -> addFlash ( 'reset_password_success' , $ this -> translator -> trans ( 'reset_password.reset_successful' ) ) ; return $ this -> redirectToRoute ( 'bolt_login' ) ; } return $ this -> render ( 'reset_password/reset.html.twig' , [ 'resetForm' => $ form -> createView ( ) , ] ) ; }
Validates and process the reset URL that the user clicked in their email.
Validates and process the reset URL that the user clicked in their email .
// We store the token in session and remove it from the URL, to avoid the URL being // loaded in a browser and potentially leaking the token to 3rd party JavaScript. // The token is valid; allow the user to change their password. // A password reset token should be used only once, remove it. // Encode the plain password, and set it. // The session is cleaned up after the password has been changed. // Added an additional flash message to show if password reset was successful