public function testPostResetWithInvalidatedTokenYeildsError()
{
$token = '34838383838';
PasswordResetRequest::generate($this->account, $token);
$request = Request::create('/resetpassword.php');
$request->setMethod('POST');
$request->request->set('token', $token);
$password = '******';
$request->request->set('new_password', $password);
$request->request->set('password_confirmation', $password);
$request->request->set('email', $this->account->getActiveEmail());
// Invalidate the token
PasswordResetRequest::where('_account_id', '=', $this->account->id())->update(['used' => true]);
// Now run the controller method to reset!
$controller = new PasswordController();
$response = $controller->postReset($request);
$this->assertTrue(stripos($response->getTargetUrl(), url('Token was invalid')) !== false, 'Url was [' . $response->getTargetUrl() . '] instead of expected not long enough password error url.');
// Password should be changed.
$this->assertFalse($this->checkTestPasswordMatches($password), 'Password should not have been changed on a rejection!');
}
public function testPerformingAResetInvalidatesUsedRequest()
{
$account_id = TestAccountCreateAndDestroy::account_id();
$account = AccountFactory::findById($account_id);
PasswordResetRequest::generate($account, $this->nonce = '77warkwark', false);
PasswordResetRequest::reset($account, 'new_pass34532');
$req = PasswordResetRequest::match($this->nonce);
$this->assertEmpty($req);
// Request shouldn't match because it should already be used.
}
/**
* Generate a full password reset request for an account
*
* @param Account $account
* @return PasswordResetRequest
*/
public static function generate(Account $account, $nonce = null)
{
$nonce = $nonce !== null ? $nonce : nonce();
return PasswordResetRequest::create(['_account_id' => $account->id(), 'nonce' => $nonce]);
}
/**
* Reset the given user's password.
*
* @return Response
*/
public function postReset(Container $p_dependencies)
{
$request = RequestWrapper::$request;
$token = $request->get('token');
$newPassword = $request->get('new_password');
$passwordConfirmation = $request->get('password_confirmation');
if ($passwordConfirmation === null || $passwordConfirmation !== $newPassword) {
return $this->renderError('Password Confirmation did not match.', $token);
}
if (!$token) {
return $this->renderError('No Valid Token to allow for password reset! Try again.', $token);
} else {
$req = PasswordResetRequest::match($token);
$account = $req instanceof PasswordResetRequest ? $req->account() : null;
if (!$account || !$account->id()) {
return $this->renderError('Token was invalid or expired! Please reset again.', $token);
} else {
if (strlen(trim($newPassword)) < 4 || $newPassword !== $passwordConfirmation) {
return $this->renderError('Password not long enough or does not match password confirmation!', $token);
} else {
PasswordResetRequest::reset($account, $newPassword);
return new RedirectResponse('/password/?message=' . rawurlencode('Password reset!'));
}
}
}
}