From 301facad776ca1bb8466da51cb4b7a950e90705b Mon Sep 17 00:00:00 2001
From: Ere Maijala <ere.maijala@helsinki.fi>
Date: Fri, 28 Oct 2016 16:13:01 +0300
Subject: [PATCH] Resolved captcha / ChoiceAuth incompatibility (#842)
- Fixed captcha check in password recovery to not lose track of the auth method and user to recover if captcha check fails.
* Refactoring to shorten newPasswordAction().
---
.../Controller/MyResearchController.php | 37 +++++++++++++++----
1 file changed, 30 insertions(+), 7 deletions(-)
diff --git a/module/VuFind/src/VuFind/Controller/MyResearchController.php b/module/VuFind/src/VuFind/Controller/MyResearchController.php
index 009cfcd6060..d43c25b284e 100644
--- a/module/VuFind/src/VuFind/Controller/MyResearchController.php
+++ b/module/VuFind/src/VuFind/Controller/MyResearchController.php
@@ -32,7 +32,8 @@ use VuFind\Exception\Auth as AuthException,
VuFind\Exception\Mail as MailException,
VuFind\Exception\ListPermission as ListPermissionException,
VuFind\Exception\RecordMissing as RecordMissingException,
- VuFind\Search\RecommendListener, Zend\Stdlib\Parameters;
+ VuFind\Search\RecommendListener, Zend\Stdlib\Parameters,
+ Zend\View\Model\ViewModel;
/**
* Controller for the user account area.
@@ -1350,6 +1351,26 @@ class MyResearchController extends AbstractBase
return $this->forwardTo('MyResearch', 'Login');
}
+ /**
+ * Reset the new password form and return the modified view. When a user has
+ * already been loaded from an existing hash, this resets the hash and updates
+ * the form so that the user can try again.
+ *
+ * @param mixed $userFromHash User loaded from database, or false if none.
+ * @param ViewModel $view View object
+ *
+ * @return ViewModel
+ */
+ protected function resetNewPasswordForm($userFromHash, ViewModel $view)
+ {
+ if ($userFromHash) {
+ $userFromHash->updateHash();
+ $view->username = $userFromHash->username;
+ $view->hash = $userFromHash->verify_hash;
+ }
+ return $view;
+ }
+
/**
* Handling submission of a new password for a user.
*
@@ -1375,7 +1396,8 @@ class MyResearchController extends AbstractBase
$view->useRecaptcha = $this->recaptcha()->active('changePassword');
// Check reCaptcha
if (!$this->formWasSubmitted('submit', $view->useRecaptcha)) {
- return $view;
+ $this->setUpAuthenticationFromRequest();
+ return $this->resetNewPasswordForm($userFromHash, $view);
}
// Missing or invalid hash
if (false == $userFromHash) {
@@ -1386,10 +1408,7 @@ class MyResearchController extends AbstractBase
} elseif ($userFromHash->username !== $post->username) {
$this->flashMessenger()
->addMessage('authentication_error_invalid', 'error');
- $userFromHash->updateHash();
- $view->username = $userFromHash->username;
- $view->hash = $userFromHash->verify_hash;
- return $view;
+ return $this->resetNewPasswordForm($userFromHash, $view);
}
// Verify old password if we're logged in
if ($this->getUser()) {
@@ -1476,7 +1495,11 @@ class MyResearchController extends AbstractBase
*/
protected function setUpAuthenticationFromRequest()
{
- $method = trim($this->params()->fromQuery('auth_method'));
+ $method = trim(
+ $this->params()->fromQuery(
+ 'auth_method', $this->params()->fromPost('auth_method')
+ )
+ );
if (!empty($method)) {
$this->getAuthManager()->setAuthMethod($method);
}
--
GitLab