@@ -59,338 +59,338 @@ |
||
59 | 59 | */ |
60 | 60 | class LostController extends Controller { |
61 | 61 | |
62 | - /** @var IURLGenerator */ |
|
63 | - protected $urlGenerator; |
|
64 | - /** @var IUserManager */ |
|
65 | - protected $userManager; |
|
66 | - /** @var Defaults */ |
|
67 | - protected $defaults; |
|
68 | - /** @var IL10N */ |
|
69 | - protected $l10n; |
|
70 | - /** @var string */ |
|
71 | - protected $from; |
|
72 | - /** @var IManager */ |
|
73 | - protected $encryptionManager; |
|
74 | - /** @var IConfig */ |
|
75 | - protected $config; |
|
76 | - /** @var ISecureRandom */ |
|
77 | - protected $secureRandom; |
|
78 | - /** @var IMailer */ |
|
79 | - protected $mailer; |
|
80 | - /** @var ITimeFactory */ |
|
81 | - protected $timeFactory; |
|
82 | - /** @var ICrypto */ |
|
83 | - protected $crypto; |
|
84 | - /** @var ILogger */ |
|
85 | - private $logger; |
|
86 | - |
|
87 | - /** |
|
88 | - * @param string $appName |
|
89 | - * @param IRequest $request |
|
90 | - * @param IURLGenerator $urlGenerator |
|
91 | - * @param IUserManager $userManager |
|
92 | - * @param Defaults $defaults |
|
93 | - * @param IL10N $l10n |
|
94 | - * @param IConfig $config |
|
95 | - * @param ISecureRandom $secureRandom |
|
96 | - * @param string $defaultMailAddress |
|
97 | - * @param IManager $encryptionManager |
|
98 | - * @param IMailer $mailer |
|
99 | - * @param ITimeFactory $timeFactory |
|
100 | - * @param ICrypto $crypto |
|
101 | - */ |
|
102 | - public function __construct($appName, |
|
103 | - IRequest $request, |
|
104 | - IURLGenerator $urlGenerator, |
|
105 | - IUserManager $userManager, |
|
106 | - Defaults $defaults, |
|
107 | - IL10N $l10n, |
|
108 | - IConfig $config, |
|
109 | - ISecureRandom $secureRandom, |
|
110 | - $defaultMailAddress, |
|
111 | - IManager $encryptionManager, |
|
112 | - IMailer $mailer, |
|
113 | - ITimeFactory $timeFactory, |
|
114 | - ICrypto $crypto, |
|
115 | - ILogger $logger) { |
|
116 | - parent::__construct($appName, $request); |
|
117 | - $this->urlGenerator = $urlGenerator; |
|
118 | - $this->userManager = $userManager; |
|
119 | - $this->defaults = $defaults; |
|
120 | - $this->l10n = $l10n; |
|
121 | - $this->secureRandom = $secureRandom; |
|
122 | - $this->from = $defaultMailAddress; |
|
123 | - $this->encryptionManager = $encryptionManager; |
|
124 | - $this->config = $config; |
|
125 | - $this->mailer = $mailer; |
|
126 | - $this->timeFactory = $timeFactory; |
|
127 | - $this->crypto = $crypto; |
|
128 | - $this->logger = $logger; |
|
129 | - } |
|
130 | - |
|
131 | - /** |
|
132 | - * Someone wants to reset their password: |
|
133 | - * |
|
134 | - * @PublicPage |
|
135 | - * @NoCSRFRequired |
|
136 | - * |
|
137 | - * @param string $token |
|
138 | - * @param string $userId |
|
139 | - * @return TemplateResponse |
|
140 | - */ |
|
141 | - public function resetform($token, $userId) { |
|
142 | - if ($this->config->getSystemValue('lost_password_link', '') !== '') { |
|
143 | - return new TemplateResponse('core', 'error', [ |
|
144 | - 'errors' => [['error' => $this->l10n->t('Password reset is disabled')]] |
|
145 | - ], |
|
146 | - 'guest' |
|
147 | - ); |
|
148 | - } |
|
149 | - |
|
150 | - try { |
|
151 | - $this->checkPasswordResetToken($token, $userId); |
|
152 | - } catch (\Exception $e) { |
|
153 | - return new TemplateResponse( |
|
154 | - 'core', 'error', [ |
|
155 | - "errors" => array(array("error" => $e->getMessage())) |
|
156 | - ], |
|
157 | - 'guest' |
|
158 | - ); |
|
159 | - } |
|
160 | - |
|
161 | - return new TemplateResponse( |
|
162 | - 'core', |
|
163 | - 'lostpassword/resetpassword', |
|
164 | - array( |
|
165 | - 'link' => $this->urlGenerator->linkToRouteAbsolute('core.lost.setPassword', array('userId' => $userId, 'token' => $token)), |
|
166 | - ), |
|
167 | - 'guest' |
|
168 | - ); |
|
169 | - } |
|
170 | - |
|
171 | - /** |
|
172 | - * @param string $token |
|
173 | - * @param string $userId |
|
174 | - * @throws \Exception |
|
175 | - */ |
|
176 | - protected function checkPasswordResetToken($token, $userId) { |
|
177 | - $user = $this->userManager->get($userId); |
|
178 | - if($user === null || !$user->isEnabled()) { |
|
179 | - throw new \Exception($this->l10n->t('Couldn\'t reset password because the token is invalid')); |
|
180 | - } |
|
181 | - |
|
182 | - try { |
|
183 | - $encryptedToken = $this->config->getUserValue($userId, 'core', 'lostpassword', null); |
|
184 | - $mailAddress = !is_null($user->getEMailAddress()) ? $user->getEMailAddress() : ''; |
|
185 | - $decryptedToken = $this->crypto->decrypt($encryptedToken, $mailAddress.$this->config->getSystemValue('secret')); |
|
186 | - } catch (\Exception $e) { |
|
187 | - throw new \Exception($this->l10n->t('Couldn\'t reset password because the token is invalid')); |
|
188 | - } |
|
189 | - |
|
190 | - $splittedToken = explode(':', $decryptedToken); |
|
191 | - if(count($splittedToken) !== 2) { |
|
192 | - throw new \Exception($this->l10n->t('Couldn\'t reset password because the token is invalid')); |
|
193 | - } |
|
194 | - |
|
195 | - if ($splittedToken[0] < ($this->timeFactory->getTime() - 60*60*24*7) || |
|
196 | - $user->getLastLogin() > $splittedToken[0]) { |
|
197 | - throw new \Exception($this->l10n->t('Couldn\'t reset password because the token is expired')); |
|
198 | - } |
|
199 | - |
|
200 | - if (!hash_equals($splittedToken[1], $token)) { |
|
201 | - throw new \Exception($this->l10n->t('Couldn\'t reset password because the token is invalid')); |
|
202 | - } |
|
203 | - } |
|
204 | - |
|
205 | - /** |
|
206 | - * @param $message |
|
207 | - * @param array $additional |
|
208 | - * @return array |
|
209 | - */ |
|
210 | - private function error($message, array $additional=array()) { |
|
211 | - return array_merge(array('status' => 'error', 'msg' => $message), $additional); |
|
212 | - } |
|
213 | - |
|
214 | - /** |
|
215 | - * @param array $data |
|
216 | - * @return array |
|
217 | - */ |
|
218 | - private function success($data = []) { |
|
219 | - return array_merge($data, ['status'=>'success']); |
|
220 | - } |
|
221 | - |
|
222 | - /** |
|
223 | - * @PublicPage |
|
224 | - * @BruteForceProtection(action=passwordResetEmail) |
|
225 | - * @AnonRateThrottle(limit=10, period=300) |
|
226 | - * |
|
227 | - * @param string $user |
|
228 | - * @return JSONResponse |
|
229 | - */ |
|
230 | - public function email($user){ |
|
231 | - if ($this->config->getSystemValue('lost_password_link', '') !== '') { |
|
232 | - return new JSONResponse($this->error($this->l10n->t('Password reset is disabled'))); |
|
233 | - } |
|
234 | - |
|
235 | - \OCP\Util::emitHook( |
|
236 | - '\OCA\Files_Sharing\API\Server2Server', |
|
237 | - 'preLoginNameUsedAsUserName', |
|
238 | - ['uid' => &$user] |
|
239 | - ); |
|
240 | - |
|
241 | - // FIXME: use HTTP error codes |
|
242 | - try { |
|
243 | - $this->sendEmail($user); |
|
244 | - } catch (\Exception $e) { |
|
245 | - // Ignore the error since we do not want to leak this info |
|
246 | - $this->logger->logException($e, [ |
|
247 | - 'level' => ILogger::WARN |
|
248 | - ]); |
|
249 | - } |
|
250 | - |
|
251 | - $response = new JSONResponse($this->success()); |
|
252 | - $response->throttle(); |
|
253 | - return $response; |
|
254 | - } |
|
255 | - |
|
256 | - /** |
|
257 | - * @PublicPage |
|
258 | - * @param string $token |
|
259 | - * @param string $userId |
|
260 | - * @param string $password |
|
261 | - * @param boolean $proceed |
|
262 | - * @return array |
|
263 | - */ |
|
264 | - public function setPassword($token, $userId, $password, $proceed) { |
|
265 | - if ($this->config->getSystemValue('lost_password_link', '') !== '') { |
|
266 | - return $this->error($this->l10n->t('Password reset is disabled')); |
|
267 | - } |
|
268 | - |
|
269 | - if ($this->encryptionManager->isEnabled() && !$proceed) { |
|
270 | - $encryptionModules = $this->encryptionManager->getEncryptionModules(); |
|
271 | - foreach ($encryptionModules as $module) { |
|
272 | - /** @var IEncryptionModule $instance */ |
|
273 | - $instance = call_user_func($module['callback']); |
|
274 | - // this way we can find out whether per-user keys are used or a system wide encryption key |
|
275 | - if ($instance->needDetailedAccessList()) { |
|
276 | - return $this->error('', array('encryption' => true)); |
|
277 | - } |
|
278 | - } |
|
279 | - } |
|
280 | - |
|
281 | - try { |
|
282 | - $this->checkPasswordResetToken($token, $userId); |
|
283 | - $user = $this->userManager->get($userId); |
|
284 | - |
|
285 | - \OC_Hook::emit('\OC\Core\LostPassword\Controller\LostController', 'pre_passwordReset', array('uid' => $userId, 'password' => $password)); |
|
286 | - |
|
287 | - if (!$user->setPassword($password)) { |
|
288 | - throw new \Exception(); |
|
289 | - } |
|
290 | - |
|
291 | - \OC_Hook::emit('\OC\Core\LostPassword\Controller\LostController', 'post_passwordReset', array('uid' => $userId, 'password' => $password)); |
|
292 | - |
|
293 | - $this->config->deleteUserValue($userId, 'core', 'lostpassword'); |
|
294 | - @\OC::$server->getUserSession()->unsetMagicInCookie(); |
|
295 | - } catch (HintException $e){ |
|
296 | - return $this->error($e->getHint()); |
|
297 | - } catch (\Exception $e){ |
|
298 | - return $this->error($e->getMessage()); |
|
299 | - } |
|
300 | - |
|
301 | - return $this->success(['user' => $userId]); |
|
302 | - } |
|
303 | - |
|
304 | - /** |
|
305 | - * @param string $input |
|
306 | - * @throws \Exception |
|
307 | - */ |
|
308 | - protected function sendEmail($input) { |
|
309 | - $user = $this->findUserByIdOrMail($input); |
|
310 | - $email = $user->getEMailAddress(); |
|
311 | - |
|
312 | - if (empty($email)) { |
|
313 | - throw new \Exception( |
|
314 | - $this->l10n->t('Could not send reset email because there is no email address for this username. Please contact your administrator.') |
|
315 | - ); |
|
316 | - } |
|
317 | - |
|
318 | - // Generate the token. It is stored encrypted in the database with the |
|
319 | - // secret being the users' email address appended with the system secret. |
|
320 | - // This makes the token automatically invalidate once the user changes |
|
321 | - // their email address. |
|
322 | - $token = $this->secureRandom->generate( |
|
323 | - 21, |
|
324 | - ISecureRandom::CHAR_DIGITS. |
|
325 | - ISecureRandom::CHAR_LOWER. |
|
326 | - ISecureRandom::CHAR_UPPER |
|
327 | - ); |
|
328 | - $tokenValue = $this->timeFactory->getTime() .':'. $token; |
|
329 | - $encryptedValue = $this->crypto->encrypt($tokenValue, $email . $this->config->getSystemValue('secret')); |
|
330 | - $this->config->setUserValue($user->getUID(), 'core', 'lostpassword', $encryptedValue); |
|
331 | - |
|
332 | - $link = $this->urlGenerator->linkToRouteAbsolute('core.lost.resetform', array('userId' => $user->getUID(), 'token' => $token)); |
|
333 | - |
|
334 | - $emailTemplate = $this->mailer->createEMailTemplate('core.ResetPassword', [ |
|
335 | - 'link' => $link, |
|
336 | - ]); |
|
337 | - |
|
338 | - $emailTemplate->setSubject($this->l10n->t('%s password reset', [$this->defaults->getName()])); |
|
339 | - $emailTemplate->addHeader(); |
|
340 | - $emailTemplate->addHeading($this->l10n->t('Password reset')); |
|
341 | - |
|
342 | - $emailTemplate->addBodyText( |
|
343 | - htmlspecialchars($this->l10n->t('Click the following button to reset your password. If you have not requested the password reset, then ignore this email.')), |
|
344 | - $this->l10n->t('Click the following link to reset your password. If you have not requested the password reset, then ignore this email.') |
|
345 | - ); |
|
346 | - |
|
347 | - $emailTemplate->addBodyButton( |
|
348 | - htmlspecialchars($this->l10n->t('Reset your password')), |
|
349 | - $link, |
|
350 | - false |
|
351 | - ); |
|
352 | - $emailTemplate->addFooter(); |
|
353 | - |
|
354 | - try { |
|
355 | - $message = $this->mailer->createMessage(); |
|
356 | - $message->setTo([$email => $user->getUID()]); |
|
357 | - $message->setFrom([$this->from => $this->defaults->getName()]); |
|
358 | - $message->useTemplate($emailTemplate); |
|
359 | - $this->mailer->send($message); |
|
360 | - } catch (\Exception $e) { |
|
361 | - throw new \Exception($this->l10n->t( |
|
362 | - 'Couldn\'t send reset email. Please contact your administrator.' |
|
363 | - )); |
|
364 | - } |
|
365 | - } |
|
366 | - |
|
367 | - /** |
|
368 | - * @param string $input |
|
369 | - * @return IUser |
|
370 | - * @throws \InvalidArgumentException |
|
371 | - */ |
|
372 | - protected function findUserByIdOrMail($input) { |
|
373 | - $userNotFound = new \InvalidArgumentException( |
|
374 | - $this->l10n->t('Couldn\'t send reset email. Please make sure your username is correct.') |
|
375 | - ); |
|
376 | - |
|
377 | - $user = $this->userManager->get($input); |
|
378 | - if ($user instanceof IUser) { |
|
379 | - if (!$user->isEnabled()) { |
|
380 | - throw $userNotFound; |
|
381 | - } |
|
382 | - |
|
383 | - return $user; |
|
384 | - } |
|
385 | - |
|
386 | - $users = \array_filter($this->userManager->getByEmail($input), function (IUser $user) { |
|
387 | - return $user->isEnabled(); |
|
388 | - }); |
|
389 | - |
|
390 | - if (\count($users) === 1) { |
|
391 | - return $users[0]; |
|
392 | - } |
|
393 | - |
|
394 | - throw $userNotFound; |
|
395 | - } |
|
62 | + /** @var IURLGenerator */ |
|
63 | + protected $urlGenerator; |
|
64 | + /** @var IUserManager */ |
|
65 | + protected $userManager; |
|
66 | + /** @var Defaults */ |
|
67 | + protected $defaults; |
|
68 | + /** @var IL10N */ |
|
69 | + protected $l10n; |
|
70 | + /** @var string */ |
|
71 | + protected $from; |
|
72 | + /** @var IManager */ |
|
73 | + protected $encryptionManager; |
|
74 | + /** @var IConfig */ |
|
75 | + protected $config; |
|
76 | + /** @var ISecureRandom */ |
|
77 | + protected $secureRandom; |
|
78 | + /** @var IMailer */ |
|
79 | + protected $mailer; |
|
80 | + /** @var ITimeFactory */ |
|
81 | + protected $timeFactory; |
|
82 | + /** @var ICrypto */ |
|
83 | + protected $crypto; |
|
84 | + /** @var ILogger */ |
|
85 | + private $logger; |
|
86 | + |
|
87 | + /** |
|
88 | + * @param string $appName |
|
89 | + * @param IRequest $request |
|
90 | + * @param IURLGenerator $urlGenerator |
|
91 | + * @param IUserManager $userManager |
|
92 | + * @param Defaults $defaults |
|
93 | + * @param IL10N $l10n |
|
94 | + * @param IConfig $config |
|
95 | + * @param ISecureRandom $secureRandom |
|
96 | + * @param string $defaultMailAddress |
|
97 | + * @param IManager $encryptionManager |
|
98 | + * @param IMailer $mailer |
|
99 | + * @param ITimeFactory $timeFactory |
|
100 | + * @param ICrypto $crypto |
|
101 | + */ |
|
102 | + public function __construct($appName, |
|
103 | + IRequest $request, |
|
104 | + IURLGenerator $urlGenerator, |
|
105 | + IUserManager $userManager, |
|
106 | + Defaults $defaults, |
|
107 | + IL10N $l10n, |
|
108 | + IConfig $config, |
|
109 | + ISecureRandom $secureRandom, |
|
110 | + $defaultMailAddress, |
|
111 | + IManager $encryptionManager, |
|
112 | + IMailer $mailer, |
|
113 | + ITimeFactory $timeFactory, |
|
114 | + ICrypto $crypto, |
|
115 | + ILogger $logger) { |
|
116 | + parent::__construct($appName, $request); |
|
117 | + $this->urlGenerator = $urlGenerator; |
|
118 | + $this->userManager = $userManager; |
|
119 | + $this->defaults = $defaults; |
|
120 | + $this->l10n = $l10n; |
|
121 | + $this->secureRandom = $secureRandom; |
|
122 | + $this->from = $defaultMailAddress; |
|
123 | + $this->encryptionManager = $encryptionManager; |
|
124 | + $this->config = $config; |
|
125 | + $this->mailer = $mailer; |
|
126 | + $this->timeFactory = $timeFactory; |
|
127 | + $this->crypto = $crypto; |
|
128 | + $this->logger = $logger; |
|
129 | + } |
|
130 | + |
|
131 | + /** |
|
132 | + * Someone wants to reset their password: |
|
133 | + * |
|
134 | + * @PublicPage |
|
135 | + * @NoCSRFRequired |
|
136 | + * |
|
137 | + * @param string $token |
|
138 | + * @param string $userId |
|
139 | + * @return TemplateResponse |
|
140 | + */ |
|
141 | + public function resetform($token, $userId) { |
|
142 | + if ($this->config->getSystemValue('lost_password_link', '') !== '') { |
|
143 | + return new TemplateResponse('core', 'error', [ |
|
144 | + 'errors' => [['error' => $this->l10n->t('Password reset is disabled')]] |
|
145 | + ], |
|
146 | + 'guest' |
|
147 | + ); |
|
148 | + } |
|
149 | + |
|
150 | + try { |
|
151 | + $this->checkPasswordResetToken($token, $userId); |
|
152 | + } catch (\Exception $e) { |
|
153 | + return new TemplateResponse( |
|
154 | + 'core', 'error', [ |
|
155 | + "errors" => array(array("error" => $e->getMessage())) |
|
156 | + ], |
|
157 | + 'guest' |
|
158 | + ); |
|
159 | + } |
|
160 | + |
|
161 | + return new TemplateResponse( |
|
162 | + 'core', |
|
163 | + 'lostpassword/resetpassword', |
|
164 | + array( |
|
165 | + 'link' => $this->urlGenerator->linkToRouteAbsolute('core.lost.setPassword', array('userId' => $userId, 'token' => $token)), |
|
166 | + ), |
|
167 | + 'guest' |
|
168 | + ); |
|
169 | + } |
|
170 | + |
|
171 | + /** |
|
172 | + * @param string $token |
|
173 | + * @param string $userId |
|
174 | + * @throws \Exception |
|
175 | + */ |
|
176 | + protected function checkPasswordResetToken($token, $userId) { |
|
177 | + $user = $this->userManager->get($userId); |
|
178 | + if($user === null || !$user->isEnabled()) { |
|
179 | + throw new \Exception($this->l10n->t('Couldn\'t reset password because the token is invalid')); |
|
180 | + } |
|
181 | + |
|
182 | + try { |
|
183 | + $encryptedToken = $this->config->getUserValue($userId, 'core', 'lostpassword', null); |
|
184 | + $mailAddress = !is_null($user->getEMailAddress()) ? $user->getEMailAddress() : ''; |
|
185 | + $decryptedToken = $this->crypto->decrypt($encryptedToken, $mailAddress.$this->config->getSystemValue('secret')); |
|
186 | + } catch (\Exception $e) { |
|
187 | + throw new \Exception($this->l10n->t('Couldn\'t reset password because the token is invalid')); |
|
188 | + } |
|
189 | + |
|
190 | + $splittedToken = explode(':', $decryptedToken); |
|
191 | + if(count($splittedToken) !== 2) { |
|
192 | + throw new \Exception($this->l10n->t('Couldn\'t reset password because the token is invalid')); |
|
193 | + } |
|
194 | + |
|
195 | + if ($splittedToken[0] < ($this->timeFactory->getTime() - 60*60*24*7) || |
|
196 | + $user->getLastLogin() > $splittedToken[0]) { |
|
197 | + throw new \Exception($this->l10n->t('Couldn\'t reset password because the token is expired')); |
|
198 | + } |
|
199 | + |
|
200 | + if (!hash_equals($splittedToken[1], $token)) { |
|
201 | + throw new \Exception($this->l10n->t('Couldn\'t reset password because the token is invalid')); |
|
202 | + } |
|
203 | + } |
|
204 | + |
|
205 | + /** |
|
206 | + * @param $message |
|
207 | + * @param array $additional |
|
208 | + * @return array |
|
209 | + */ |
|
210 | + private function error($message, array $additional=array()) { |
|
211 | + return array_merge(array('status' => 'error', 'msg' => $message), $additional); |
|
212 | + } |
|
213 | + |
|
214 | + /** |
|
215 | + * @param array $data |
|
216 | + * @return array |
|
217 | + */ |
|
218 | + private function success($data = []) { |
|
219 | + return array_merge($data, ['status'=>'success']); |
|
220 | + } |
|
221 | + |
|
222 | + /** |
|
223 | + * @PublicPage |
|
224 | + * @BruteForceProtection(action=passwordResetEmail) |
|
225 | + * @AnonRateThrottle(limit=10, period=300) |
|
226 | + * |
|
227 | + * @param string $user |
|
228 | + * @return JSONResponse |
|
229 | + */ |
|
230 | + public function email($user){ |
|
231 | + if ($this->config->getSystemValue('lost_password_link', '') !== '') { |
|
232 | + return new JSONResponse($this->error($this->l10n->t('Password reset is disabled'))); |
|
233 | + } |
|
234 | + |
|
235 | + \OCP\Util::emitHook( |
|
236 | + '\OCA\Files_Sharing\API\Server2Server', |
|
237 | + 'preLoginNameUsedAsUserName', |
|
238 | + ['uid' => &$user] |
|
239 | + ); |
|
240 | + |
|
241 | + // FIXME: use HTTP error codes |
|
242 | + try { |
|
243 | + $this->sendEmail($user); |
|
244 | + } catch (\Exception $e) { |
|
245 | + // Ignore the error since we do not want to leak this info |
|
246 | + $this->logger->logException($e, [ |
|
247 | + 'level' => ILogger::WARN |
|
248 | + ]); |
|
249 | + } |
|
250 | + |
|
251 | + $response = new JSONResponse($this->success()); |
|
252 | + $response->throttle(); |
|
253 | + return $response; |
|
254 | + } |
|
255 | + |
|
256 | + /** |
|
257 | + * @PublicPage |
|
258 | + * @param string $token |
|
259 | + * @param string $userId |
|
260 | + * @param string $password |
|
261 | + * @param boolean $proceed |
|
262 | + * @return array |
|
263 | + */ |
|
264 | + public function setPassword($token, $userId, $password, $proceed) { |
|
265 | + if ($this->config->getSystemValue('lost_password_link', '') !== '') { |
|
266 | + return $this->error($this->l10n->t('Password reset is disabled')); |
|
267 | + } |
|
268 | + |
|
269 | + if ($this->encryptionManager->isEnabled() && !$proceed) { |
|
270 | + $encryptionModules = $this->encryptionManager->getEncryptionModules(); |
|
271 | + foreach ($encryptionModules as $module) { |
|
272 | + /** @var IEncryptionModule $instance */ |
|
273 | + $instance = call_user_func($module['callback']); |
|
274 | + // this way we can find out whether per-user keys are used or a system wide encryption key |
|
275 | + if ($instance->needDetailedAccessList()) { |
|
276 | + return $this->error('', array('encryption' => true)); |
|
277 | + } |
|
278 | + } |
|
279 | + } |
|
280 | + |
|
281 | + try { |
|
282 | + $this->checkPasswordResetToken($token, $userId); |
|
283 | + $user = $this->userManager->get($userId); |
|
284 | + |
|
285 | + \OC_Hook::emit('\OC\Core\LostPassword\Controller\LostController', 'pre_passwordReset', array('uid' => $userId, 'password' => $password)); |
|
286 | + |
|
287 | + if (!$user->setPassword($password)) { |
|
288 | + throw new \Exception(); |
|
289 | + } |
|
290 | + |
|
291 | + \OC_Hook::emit('\OC\Core\LostPassword\Controller\LostController', 'post_passwordReset', array('uid' => $userId, 'password' => $password)); |
|
292 | + |
|
293 | + $this->config->deleteUserValue($userId, 'core', 'lostpassword'); |
|
294 | + @\OC::$server->getUserSession()->unsetMagicInCookie(); |
|
295 | + } catch (HintException $e){ |
|
296 | + return $this->error($e->getHint()); |
|
297 | + } catch (\Exception $e){ |
|
298 | + return $this->error($e->getMessage()); |
|
299 | + } |
|
300 | + |
|
301 | + return $this->success(['user' => $userId]); |
|
302 | + } |
|
303 | + |
|
304 | + /** |
|
305 | + * @param string $input |
|
306 | + * @throws \Exception |
|
307 | + */ |
|
308 | + protected function sendEmail($input) { |
|
309 | + $user = $this->findUserByIdOrMail($input); |
|
310 | + $email = $user->getEMailAddress(); |
|
311 | + |
|
312 | + if (empty($email)) { |
|
313 | + throw new \Exception( |
|
314 | + $this->l10n->t('Could not send reset email because there is no email address for this username. Please contact your administrator.') |
|
315 | + ); |
|
316 | + } |
|
317 | + |
|
318 | + // Generate the token. It is stored encrypted in the database with the |
|
319 | + // secret being the users' email address appended with the system secret. |
|
320 | + // This makes the token automatically invalidate once the user changes |
|
321 | + // their email address. |
|
322 | + $token = $this->secureRandom->generate( |
|
323 | + 21, |
|
324 | + ISecureRandom::CHAR_DIGITS. |
|
325 | + ISecureRandom::CHAR_LOWER. |
|
326 | + ISecureRandom::CHAR_UPPER |
|
327 | + ); |
|
328 | + $tokenValue = $this->timeFactory->getTime() .':'. $token; |
|
329 | + $encryptedValue = $this->crypto->encrypt($tokenValue, $email . $this->config->getSystemValue('secret')); |
|
330 | + $this->config->setUserValue($user->getUID(), 'core', 'lostpassword', $encryptedValue); |
|
331 | + |
|
332 | + $link = $this->urlGenerator->linkToRouteAbsolute('core.lost.resetform', array('userId' => $user->getUID(), 'token' => $token)); |
|
333 | + |
|
334 | + $emailTemplate = $this->mailer->createEMailTemplate('core.ResetPassword', [ |
|
335 | + 'link' => $link, |
|
336 | + ]); |
|
337 | + |
|
338 | + $emailTemplate->setSubject($this->l10n->t('%s password reset', [$this->defaults->getName()])); |
|
339 | + $emailTemplate->addHeader(); |
|
340 | + $emailTemplate->addHeading($this->l10n->t('Password reset')); |
|
341 | + |
|
342 | + $emailTemplate->addBodyText( |
|
343 | + htmlspecialchars($this->l10n->t('Click the following button to reset your password. If you have not requested the password reset, then ignore this email.')), |
|
344 | + $this->l10n->t('Click the following link to reset your password. If you have not requested the password reset, then ignore this email.') |
|
345 | + ); |
|
346 | + |
|
347 | + $emailTemplate->addBodyButton( |
|
348 | + htmlspecialchars($this->l10n->t('Reset your password')), |
|
349 | + $link, |
|
350 | + false |
|
351 | + ); |
|
352 | + $emailTemplate->addFooter(); |
|
353 | + |
|
354 | + try { |
|
355 | + $message = $this->mailer->createMessage(); |
|
356 | + $message->setTo([$email => $user->getUID()]); |
|
357 | + $message->setFrom([$this->from => $this->defaults->getName()]); |
|
358 | + $message->useTemplate($emailTemplate); |
|
359 | + $this->mailer->send($message); |
|
360 | + } catch (\Exception $e) { |
|
361 | + throw new \Exception($this->l10n->t( |
|
362 | + 'Couldn\'t send reset email. Please contact your administrator.' |
|
363 | + )); |
|
364 | + } |
|
365 | + } |
|
366 | + |
|
367 | + /** |
|
368 | + * @param string $input |
|
369 | + * @return IUser |
|
370 | + * @throws \InvalidArgumentException |
|
371 | + */ |
|
372 | + protected function findUserByIdOrMail($input) { |
|
373 | + $userNotFound = new \InvalidArgumentException( |
|
374 | + $this->l10n->t('Couldn\'t send reset email. Please make sure your username is correct.') |
|
375 | + ); |
|
376 | + |
|
377 | + $user = $this->userManager->get($input); |
|
378 | + if ($user instanceof IUser) { |
|
379 | + if (!$user->isEnabled()) { |
|
380 | + throw $userNotFound; |
|
381 | + } |
|
382 | + |
|
383 | + return $user; |
|
384 | + } |
|
385 | + |
|
386 | + $users = \array_filter($this->userManager->getByEmail($input), function (IUser $user) { |
|
387 | + return $user->isEnabled(); |
|
388 | + }); |
|
389 | + |
|
390 | + if (\count($users) === 1) { |
|
391 | + return $users[0]; |
|
392 | + } |
|
393 | + |
|
394 | + throw $userNotFound; |
|
395 | + } |
|
396 | 396 | } |
@@ -175,7 +175,7 @@ discard block |
||
175 | 175 | */ |
176 | 176 | protected function checkPasswordResetToken($token, $userId) { |
177 | 177 | $user = $this->userManager->get($userId); |
178 | - if($user === null || !$user->isEnabled()) { |
|
178 | + if ($user === null || !$user->isEnabled()) { |
|
179 | 179 | throw new \Exception($this->l10n->t('Couldn\'t reset password because the token is invalid')); |
180 | 180 | } |
181 | 181 | |
@@ -188,11 +188,11 @@ discard block |
||
188 | 188 | } |
189 | 189 | |
190 | 190 | $splittedToken = explode(':', $decryptedToken); |
191 | - if(count($splittedToken) !== 2) { |
|
191 | + if (count($splittedToken) !== 2) { |
|
192 | 192 | throw new \Exception($this->l10n->t('Couldn\'t reset password because the token is invalid')); |
193 | 193 | } |
194 | 194 | |
195 | - if ($splittedToken[0] < ($this->timeFactory->getTime() - 60*60*24*7) || |
|
195 | + if ($splittedToken[0] < ($this->timeFactory->getTime() - 60 * 60 * 24 * 7) || |
|
196 | 196 | $user->getLastLogin() > $splittedToken[0]) { |
197 | 197 | throw new \Exception($this->l10n->t('Couldn\'t reset password because the token is expired')); |
198 | 198 | } |
@@ -207,7 +207,7 @@ discard block |
||
207 | 207 | * @param array $additional |
208 | 208 | * @return array |
209 | 209 | */ |
210 | - private function error($message, array $additional=array()) { |
|
210 | + private function error($message, array $additional = array()) { |
|
211 | 211 | return array_merge(array('status' => 'error', 'msg' => $message), $additional); |
212 | 212 | } |
213 | 213 | |
@@ -227,7 +227,7 @@ discard block |
||
227 | 227 | * @param string $user |
228 | 228 | * @return JSONResponse |
229 | 229 | */ |
230 | - public function email($user){ |
|
230 | + public function email($user) { |
|
231 | 231 | if ($this->config->getSystemValue('lost_password_link', '') !== '') { |
232 | 232 | return new JSONResponse($this->error($this->l10n->t('Password reset is disabled'))); |
233 | 233 | } |
@@ -292,9 +292,9 @@ discard block |
||
292 | 292 | |
293 | 293 | $this->config->deleteUserValue($userId, 'core', 'lostpassword'); |
294 | 294 | @\OC::$server->getUserSession()->unsetMagicInCookie(); |
295 | - } catch (HintException $e){ |
|
295 | + } catch (HintException $e) { |
|
296 | 296 | return $this->error($e->getHint()); |
297 | - } catch (\Exception $e){ |
|
297 | + } catch (\Exception $e) { |
|
298 | 298 | return $this->error($e->getMessage()); |
299 | 299 | } |
300 | 300 | |
@@ -325,8 +325,8 @@ discard block |
||
325 | 325 | ISecureRandom::CHAR_LOWER. |
326 | 326 | ISecureRandom::CHAR_UPPER |
327 | 327 | ); |
328 | - $tokenValue = $this->timeFactory->getTime() .':'. $token; |
|
329 | - $encryptedValue = $this->crypto->encrypt($tokenValue, $email . $this->config->getSystemValue('secret')); |
|
328 | + $tokenValue = $this->timeFactory->getTime().':'.$token; |
|
329 | + $encryptedValue = $this->crypto->encrypt($tokenValue, $email.$this->config->getSystemValue('secret')); |
|
330 | 330 | $this->config->setUserValue($user->getUID(), 'core', 'lostpassword', $encryptedValue); |
331 | 331 | |
332 | 332 | $link = $this->urlGenerator->linkToRouteAbsolute('core.lost.resetform', array('userId' => $user->getUID(), 'token' => $token)); |
@@ -383,7 +383,7 @@ discard block |
||
383 | 383 | return $user; |
384 | 384 | } |
385 | 385 | |
386 | - $users = \array_filter($this->userManager->getByEmail($input), function (IUser $user) { |
|
386 | + $users = \array_filter($this->userManager->getByEmail($input), function(IUser $user) { |
|
387 | 387 | return $user->isEnabled(); |
388 | 388 | }); |
389 | 389 |