private function isPasswordMatching(User $user, $password)
{
if (strlen($password) > 4096) {
//Do not pass very long passwords to the encoder. Computing a hash might be slow.
//Just reject them outright.
return false;
}
return $this->encoder->isPasswordValid($password, $user->getPassword());
}
/**
* @param User $entity
* @param Request $request
* @param array $options
*/
protected function doBindRequest($entity, Request $request, array $options = array())
{
//Clear the roles first. If the request does not contain a "roles" value,
//binding below will just skip it and keep them as they were, which is not what we want.
$entity->setRoles(array());
$whitelisted = array('username', 'email', 'name', 'roles');
$this->bindWhitelisted($entity, $request->request->all(), $whitelisted);
$password = $request->request->get('password');
if ($password !== '') {
if (strlen($password) > 4096) {
$this->getViolations()->add('password', 'devture_user.validation.password_too_long');
} else {
$entity->setPassword($this->encoder->encodePassword($password));
}
}
}
private function validateEmail(User $entity, ViolationsList $violations)
{
$email = $entity->getEmail();
if ($this->isEmpty($email)) {
//Empty is okay, non-required field.
return;
}
if (!EmailValidator::isValid($email)) {
$violations->add('email', 'devture_user.validation.email.invalid');
return;
}
//Make sure it's unique, so it can potentially be used as an alternative user identifier.
try {
$user = $this->repository->findByEmail($email);
if ($user->getId() !== $entity->getId()) {
$violations->add('email', 'devture_user.validation.email.in_use', array('%username%' => $user->getUsername()));
}
} catch (NotFound $e) {
}
}
/**
* @param User $user
* @param Request $request
* @param Response $response
*/
public function extendSessionIfNeeded(User $user, Request $request, Response $response)
{
if (!$request->attributes->has(self::REQUEST_ATTRIBUTE_EXTEND_SESSION)) {
return;
}
$id = $request->attributes->get(self::REQUEST_ATTRIBUTE_EXTEND_SESSION);
if ((string) $user->getId() !== $id) {
//The user whose session we were about to extend is different than the one given.
//Something weird is going on. Don't perform the extension on this request/response cycle.
return;
}
$this->login($user, $response);
}