LDAPLoginForm::forgotPassword() - Code Metrics - silverstripe/silverstripe-activedirectory - Measure and Improve Code Quality continuously with Scrutinizer

LDAPLoginForm::forgotPassword() C
last analyzed 2018-07-22 22:44 UTC

↳ Parent: LDAPLoginForm

Complexity

Conditions	12
Paths	23

Size

Total Lines

Duplication

Lines	4
Ratio	4.44 %

Importance

Changes

Metric	Value
dl	4
loc	90
rs	5.7915
c	0
b	0
f	0
cc	12
nc	23
nop	1

How to fix Long Method Complexity

<?php
/**
 * Class LDAPLoginForm
 *
 * This not very interesting in itself. It's pretty much boiler-plate code to access the authenticator.
 */
class LDAPLoginForm extends MemberLoginForm
namespace YourVendor;

class YourClass { }
{
    /**
     * This field is used in the "You are logged in as %s" message
     * @var string
     */
    public $loggedInAsField = 'FirstName';

    /**
     * @var string
     */
    protected $authenticator_class = 'LDAPAuthenticator';

    /**
     * @var LDAPSecurityController
     */
    protected $ldapSecController = null;

    /**
     * Time in seconds that we use to ensure consistent repsonse times
     *
     * @var int
     */
    const RESPONSE_TIME = 2;

    /**
     * Enables consistent handling times of password resets
     * @config
     */
    private static $consistent_password_times = false;



    /**
     * Constructor.
     *
     * @param Controller $controller
     * @param string $name method on the $controller
     * @param FieldList $fields
     * @param FieldList $actions
     * @param bool $checkCurrentUser - show logout button if logged in
     */
    public function __construct($controller, $name, $fields = null, $actions = null, $checkCurrentUser = true)
    {
        parent::__construct($controller, $name, $fields, $actions, $checkCurrentUser);

        // will be used to get correct Link()
        $this->ldapSecController = Injector::inst()->create('LDAPSecurityController');

        if (Config::inst()->get('LDAPAuthenticator', 'allow_email_login')==='yes') {
            $loginField = new TextField('Login', _t('LDAPLoginForm.USERNAMEOREMAIL', 'Username or email'), null, null, $this);
        } else {
            $loginField = new TextField('Login', _t('LDAPLoginForm.USERNAME', 'Username'), null, null, $this);
        }

        $this->Fields()->replaceField('Email', $loginField);
        $this->setValidator(new RequiredFields('Login', 'Password'));
        if (Security::config()->remember_username) {
            $loginField->setValue(Session::get('SessionForms.MemberLoginForm.Email'));
        } else {
            // Some browsers won't respect this attribute unless it's added to the form
            $this->setAttribute('autocomplete', 'off');
            $loginField->setAttribute('autocomplete', 'off');
        }

        // Users can't change passwords unless appropriate a LDAP user with write permissions is
        // configured the LDAP connection binding
        $this->Actions()->remove($this->Actions()->fieldByName('forgotPassword'));
        $allowPasswordChange = Config::inst()->get('LDAPService', 'allow_password_change');
        if ($allowPasswordChange && $name != 'LostPasswordForm' && !Member::currentUser()) {
            $forgotPasswordLink = sprintf('<p id="ForgotPassword"><a href="%s">%s</a></p>',
                $this->ldapSecController->Link('lostpassword'),
                _t('Member.BUTTONLOSTPASSWORD', "I've lost my password")
            );
            $forgotPassword = new LiteralField('forgotPassword', $forgotPasswordLink);
            $this->Actions()->add($forgotPassword);
        }

        // Focus on the Username field when the page is loaded
        Requirements::block('MemberLoginFormFieldFocus');
        $js = <<<JS
            (function() {
                var el = document.getElementById("Login");
                if(el && el.focus && (typeof jQuery == 'undefined' || jQuery(el).is(':visible'))) el.focus();
            })();
JS;
        Requirements::customScript($js, 'LDAPLoginFormFieldFocus');
    }

    /**
     * Forgot password form handler method.
     *
     * Called when the user clicks on "I've lost my password".
     *
     * Extensions can use the 'forgotPassword' method to veto executing
     * the logic, by returning FALSE. In this case, the user will be redirected back
     * to the form without further action. It is recommended to set a message
     * in the form detailing why the action was denied.
     *
     * Overridden because we need to generate a link to the LDAPSecurityController
     * instead of the SecurityController
     *
     * @param array $data Submitted data
     * @return SS_HTTPResponse
     */
    public function forgotPassword($data)
    {
        // Passing true returns a float rather than a string
        $startTime = microtime(true);
        // No need to protect against injections, LDAPService will ensure that this is safe
        $login = trim($data['Login']);

        $service = Injector::inst()->get('LDAPService');
        if (Email::validEmailAddress($login)) {

            if (Config::inst()->get('LDAPAuthenticator', 'allow_email_login')!='yes') {
                $this->sessionMessage(
                    _t(
                        'LDAPLoginForm.USERNAMEINSTEADOFEMAIL',
                        'Please enter your username instead of your email to get a password reset link.'
                    ),
                    'bad'
                );
                $this->consistentResponseTime($startTime);
                $this->controller->redirect($this->controller->Link('lostpassword'));
                return;
            }
            $userData = $service->getUserByEmail($login);
        } else {
            $userData = $service->getUserByUsername($login);
        }

        // Avoid information disclosure by displaying the same status,
        // regardless whether the email address actually exists
        if (!isset($userData['objectguid'])) {
            $this->consistentResponseTime($startTime);
            return $this->controller->redirect($this->controller->Link('passwordsent/')
                . urlencode($data['Login']));
        }

        $member = Member::get()->filter('GUID', $userData['objectguid'])->limit(1)->first();
        // User haven't been imported yet so do that now
        if (!($member && $member->exists())) {

            $member = new Member();
            $member->GUID = $userData['objectguid'];
        }

        // Update the users from LDAP so we are sure that the email is correct.
        // This will also write the Member record.
        $service->updateMemberFromLDAP($member);

        // Allow vetoing forgot password requests
        $results = $this->extend('forgotPassword', $member);
        if ($results && is_array($results) && in_array(false, $results, true)) {

            $this->consistentResponseTime($startTime);
            return $this->controller->redirect($this->ldapSecController->Link('lostpassword'));
        }

        if ($member) {
            $token = $member->generateAutologinTokenAndStoreHash();
            $e = Member_ForgotPasswordEmail::create();
            $e->populateTemplate($member);
            $e->populateTemplate([
                'PasswordResetLink' => LDAPSecurityController::getPasswordResetLink($member, $token)
            ]);
            $e->setTo($member->Email);
            $e->send();
            $this->consistentResponseTime($startTime);
            $this->controller->redirect($this->controller->Link('passwordsent/') . urlencode($data['Login']));
        } elseif ($data['Login']) {
            // Avoid information disclosure by displaying the same status,
            // regardless whether the email address actually exists
            $this->consistentResponseTime($startTime);
            $this->controller->redirect($this->controller->Link('passwordsent/') . urlencode($data['Login']));
        } else {
            if (Config::inst()->get('LDAPAuthenticator', 'allow_email_login')==='yes') {
                $this->sessionMessage(
                    _t(
                        'LDAPLoginForm.ENTERUSERNAMEOREMAIL',
                        'Please enter your username or your email address to get a password reset link.'
                    ),
                    'bad'
                );
            } else {
                $this->sessionMessage(
                    _t(
                        'LDAPLoginForm.ENTERUSERNAME',
                        'Please enter your username to get a password reset link.'
                    ),
                    'bad'
                );
            }
            $this->consistentResponseTime($startTime);
            $this->controller->redirect($this->controller->Link('lostpassword'));
        }
    }

    /**
     * Ensures response times are the same across all scenarios i.e. email exists or doesn't
     * this helps to avoid issues where malicious users could find if an email is legitimate based on response time
     *
     * @param float $startTime
     */
    protected function consistentResponseTime($startTime)
    {
        if (!Config::inst()->get('LDAPLoginForm', 'consistent_password_times')) {
            return;
        }

        $timeTaken = microtime(true) - $startTime;
        if ($timeTaken < self::RESPONSE_TIME) {
            $sleepTime = self::RESPONSE_TIME - $timeTaken;
            // usleep takes microseconds, so we times our sleep period by 1mil (1mil ms = 1s)
            usleep($sleepTime * 1000000);
        }

    }
}


1		<?php
2		/**
3		* Class LDAPLoginForm
4		*
5		* This not very interesting in itself. It's pretty much boiler-plate code to access the authenticator.
6		*/
7		class LDAPLoginForm extends MemberLoginForm
		0 ignored issues – show Coding Style Compatibility introduced 2016-03-22 20:04 UTC by Report Bug Copy Issue Report PSR1 recommends that each class must be in a namespace of at least one level to avoid collisions. You can fix this by adding a namespace to your class: namespace YourVendor; class YourClass { } When choosing a vendor namespace, try to pick something that is not too generic to avoid conflicts with other libraries. Loading history...
8		{
9		/**
10		* This field is used in the "You are logged in as %s" message
11		* @var string
12		*/
13		public $loggedInAsField = 'FirstName';
14
15		/**
16		* @var string
17		*/
18		protected $authenticator_class = 'LDAPAuthenticator';
19
20		/**
21		* @var LDAPSecurityController
22		*/
23		protected $ldapSecController = null;
24
25		/**
26		* Time in seconds that we use to ensure consistent repsonse times
27		*
28		* @var int
29		*/
30		const RESPONSE_TIME = 2;
31
32		/**
33		* Enables consistent handling times of password resets
34		* @config
35		*/
36		private static $consistent_password_times = false;
		0 ignored issues – show Unused Code introduced 2018-01-25 21:38 UTC by Report Bug Copy Issue Report The property `$consistent_password_times` is not used and could be removed. This check marks private properties in classes that are never used. Those properties can be removed. Loading history...
37
38
39		/**
40		* Constructor.
41		*
42		* @param Controller $controller
43		* @param string $name method on the $controller
44		* @param FieldList $fields
45		* @param FieldList $actions
46		* @param bool $checkCurrentUser - show logout button if logged in
47		*/
48		public function __construct($controller, $name, $fields = null, $actions = null, $checkCurrentUser = true)
49		{
50		parent::__construct($controller, $name, $fields, $actions, $checkCurrentUser);
51
52		// will be used to get correct Link()
53		$this->ldapSecController = Injector::inst()->create('LDAPSecurityController');
54
55		if (Config::inst()->get('LDAPAuthenticator', 'allow_email_login')==='yes') {
56		$loginField = new TextField('Login', _t('LDAPLoginForm.USERNAMEOREMAIL', 'Username or email'), null, null, $this);
57		} else {
58		$loginField = new TextField('Login', _t('LDAPLoginForm.USERNAME', 'Username'), null, null, $this);
59		}
60
61		$this->Fields()->replaceField('Email', $loginField);
62		$this->setValidator(new RequiredFields('Login', 'Password'));
63		if (Security::config()->remember_username) {
64		$loginField->setValue(Session::get('SessionForms.MemberLoginForm.Email'));
65		} else {
66		// Some browsers won't respect this attribute unless it's added to the form
67		$this->setAttribute('autocomplete', 'off');
68		$loginField->setAttribute('autocomplete', 'off');
69		}
70
71		// Users can't change passwords unless appropriate a LDAP user with write permissions is
72		// configured the LDAP connection binding
73		$this->Actions()->remove($this->Actions()->fieldByName('forgotPassword'));
74		$allowPasswordChange = Config::inst()->get('LDAPService', 'allow_password_change');
75		if ($allowPasswordChange && $name != 'LostPasswordForm' && !Member::currentUser()) {
76		$forgotPasswordLink = sprintf('<p id="ForgotPassword"><a href="%s">%s</a></p>',
77		$this->ldapSecController->Link('lostpassword'),
78		_t('Member.BUTTONLOSTPASSWORD', "I've lost my password")
79		);
80		$forgotPassword = new LiteralField('forgotPassword', $forgotPasswordLink);
81		$this->Actions()->add($forgotPassword);
82		}
83
84		// Focus on the Username field when the page is loaded
85		Requirements::block('MemberLoginFormFieldFocus');
86		$js = <<<JS
87		(function() {
88		var el = document.getElementById("Login");
89		if(el && el.focus && (typeof jQuery == 'undefined' \|\| jQuery(el).is(':visible'))) el.focus();
90		})();
91		JS;
92		Requirements::customScript($js, 'LDAPLoginFormFieldFocus');
93		}
94
95		/**
96		* Forgot password form handler method.
97		*
98		* Called when the user clicks on "I've lost my password".
99		*
100		* Extensions can use the 'forgotPassword' method to veto executing
101		* the logic, by returning FALSE. In this case, the user will be redirected back
102		* to the form without further action. It is recommended to set a message
103		* in the form detailing why the action was denied.
104		*
105		* Overridden because we need to generate a link to the LDAPSecurityController
106		* instead of the SecurityController
107		*
108		* @param array $data Submitted data
109		* @return SS_HTTPResponse
110		*/
111		public function forgotPassword($data)
112		{
113		// Passing true returns a float rather than a string
114		$startTime = microtime(true);
115		// No need to protect against injections, LDAPService will ensure that this is safe
116		$login = trim($data['Login']);
117
118		$service = Injector::inst()->get('LDAPService');
119		if (Email::validEmailAddress($login)) {
		0 ignored issues – show Deprecated Code introduced 2016-12-01 16:03 UTC by Report Bug Copy Issue Report The method `Email::validEmailAddress()` has been deprecated with message: 4.0 Use the "is_valid_address" method instead This method has been deprecated. The supplier of the class has supplied an explanatory message. The explanatory message should give you some clue as to whether and when the method will be removed from the class and what other method or class to use instead. Loading history...
120		if (Config::inst()->get('LDAPAuthenticator', 'allow_email_login')!='yes') {
121		$this->sessionMessage(
122		_t(
123		'LDAPLoginForm.USERNAMEINSTEADOFEMAIL',
124		'Please enter your username instead of your email to get a password reset link.'
125		),
126		'bad'
127		);
128		$this->consistentResponseTime($startTime);
129		$this->controller->redirect($this->controller->Link('lostpassword'));
130		return;
131		}
132		$userData = $service->getUserByEmail($login);
133		} else {
134		$userData = $service->getUserByUsername($login);
135		}
136
137		// Avoid information disclosure by displaying the same status,
138		// regardless whether the email address actually exists
139		if (!isset($userData['objectguid'])) {
140		$this->consistentResponseTime($startTime);
141		return $this->controller->redirect($this->controller->Link('passwordsent/')
142		. urlencode($data['Login']));
143		}
144
145		$member = Member::get()->filter('GUID', $userData['objectguid'])->limit(1)->first();
146		// User haven't been imported yet so do that now
147	View Code Duplication	if (!($member && $member->exists())) {
		0 ignored issues – show Duplication introduced 2016-03-22 20:04 UTC by Report Bug Copy Issue Report This code seems to be duplicated across your project. Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. Loading history...
148		$member = new Member();
149		$member->GUID = $userData['objectguid'];
150		}
151
152		// Update the users from LDAP so we are sure that the email is correct.
153		// This will also write the Member record.
154		$service->updateMemberFromLDAP($member);
155
156		// Allow vetoing forgot password requests
157		$results = $this->extend('forgotPassword', $member);
158		if ($results && is_array($results) && in_array(false, $results, true)) {
		0 ignored issues – show Bug Best Practice introduced 2017-01-16 21:03 UTC by Report Bug Copy Issue Report The expression `$results` of type `array` is implicitly converted to a boolean; are you sure this is intended? If so, consider using `! empty($expr)` instead to make it clear that you intend to check for an array without elements. This check marks implicit conversions of arrays to boolean values in a comparison. While in PHP an empty array is considered to be equal (but not identical) to false, this is not always apparent. Consider making the comparison explicit by using `empty(..)` or `! empty(...)` instead. Loading history...
159		$this->consistentResponseTime($startTime);
160		return $this->controller->redirect($this->ldapSecController->Link('lostpassword'));
161		}
162
163		if ($member) {
164		$token = $member->generateAutologinTokenAndStoreHash();
165		$e = Member_ForgotPasswordEmail::create();
166		$e->populateTemplate($member);
167		$e->populateTemplate([
168		'PasswordResetLink' => LDAPSecurityController::getPasswordResetLink($member, $token)
169		]);
170		$e->setTo($member->Email);
171		$e->send();
172		$this->consistentResponseTime($startTime);
173		$this->controller->redirect($this->controller->Link('passwordsent/') . urlencode($data['Login']));
174		} elseif ($data['Login']) {
175		// Avoid information disclosure by displaying the same status,
176		// regardless whether the email address actually exists
177		$this->consistentResponseTime($startTime);
178		$this->controller->redirect($this->controller->Link('passwordsent/') . urlencode($data['Login']));
179		} else {
180		if (Config::inst()->get('LDAPAuthenticator', 'allow_email_login')==='yes') {
181		$this->sessionMessage(
182		_t(
183		'LDAPLoginForm.ENTERUSERNAMEOREMAIL',
184		'Please enter your username or your email address to get a password reset link.'
185		),
186		'bad'
187		);
188		} else {
189		$this->sessionMessage(
190		_t(
191		'LDAPLoginForm.ENTERUSERNAME',
192		'Please enter your username to get a password reset link.'
193		),
194		'bad'
195		);
196		}
197		$this->consistentResponseTime($startTime);
198		$this->controller->redirect($this->controller->Link('lostpassword'));
199		}
200		}
201
202		/**
203		* Ensures response times are the same across all scenarios i.e. email exists or doesn't
204		* this helps to avoid issues where malicious users could find if an email is legitimate based on response time
205		*
206		* @param float $startTime
207		*/
208		protected function consistentResponseTime($startTime)
209		{
210		if (!Config::inst()->get('LDAPLoginForm', 'consistent_password_times')) {
211		return;
212		}
213
214		$timeTaken = microtime(true) - $startTime;
215		if ($timeTaken < self::RESPONSE_TIME) {
216		$sleepTime = self::RESPONSE_TIME - $timeTaken;
217		// usleep takes microseconds, so we times our sleep period by 1mil (1mil ms = 1s)
218		usleep($sleepTime * 1000000);
219		}
220
221		}
222		}
223

silverstripe / silverstripe-activedirectory

LDAPLoginForm::forgotPassword() C last analyzed 2018-07-22 22:44 UTC

Complexity

Size

Duplication

Importance

How to fix Long Method Complexity

Long Method

Duplication Side-by-Side

Filter issues like

LDAPLoginForm::forgotPassword() C
last analyzed 2018-07-22 22:44 UTC