Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[5.2] Fix password reset broken in backend #44723

Merged
merged 4 commits into from
Jan 18, 2025
Merged

[5.2] Fix password reset broken in backend #44723

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
702d0c5
Fix password reset broken in backend
joomdonation Jan 12, 2025
6fe7ad0
CS
joomdonation Jan 12, 2025
4c04963
Use $this->getIdentity()
joomdonation Jan 16, 2025
7dcaf9b
Merge branch '5.2-dev' into check_user_reset_improvement
Hackwar Jan 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
114 changes: 57 additions & 57 deletions libraries/src/Application/CMSApplication.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -406,74 +406,74 @@ protected function checkUserRequireReset($option, $view, $layout, $tasks)
*/
protected function checkUserRequiresReset($option, $view, $layout, $urls = [])
{
if ($this->getIdentity()->requireReset) {
$redirect = false;

/*
* By default user profile edit page is used.
* That page allows you to change more than just the password and might not be the desired behavior.
* This allows a developer to override the page that manage the password reset.
* (can be configured using the file: configuration.php, or if extended, through the global configuration form)
*/
$name = $this->getName();

if ($this->get($name . '_reset_password_override', 0)) {
$option = $this->get($name . '_reset_password_option', '');
$view = $this->get($name . '_reset_password_view', '');
$layout = $this->get($name . '_reset_password_layout', '');
$urls = $this->get($name . '_reset_password_urls', $urls);
}

// If the current URL matches an entry in $urls, we do not redirect
if (\count($urls)) {
$found = false;

foreach ($urls as $url) {
$found2 = false;
// Password reset is not required for the user, no need to check it further
if (!$this->getIdentity()->requireReset) {
return;
}

foreach ($url as $key => $value) {
if ($this->input->getCmd($key) !== $value) {
$found2 = false;
break;
}
/*
* By default user profile edit page is used.
* That page allows you to change more than just the password and might not be the desired behavior.
* This allows a developer to override the page that manage the password reset.
* (can be configured using the file: configuration.php, or if extended, through the global configuration form)
*/
$name = $this->getName();

$found2 = true;
}
if ($this->get($name . '_reset_password_override', 0)) {
$option = $this->get($name . '_reset_password_option', '');
$view = $this->get($name . '_reset_password_view', '');
$layout = $this->get($name . '_reset_password_layout', '');
$urls = $this->get($name . '_reset_password_urls', $urls);
}

if ($found2) {
$found = true;
break;
}
}
/**
* The page which manage password reset always need to accessible, so if the current page
* is managing password reset page, no need to check it further
*/
if (
$this->input->getCmd('option', '') === $option
&& $this->input->getCmd('view', '') === $view
&& $this->input->getCmd('layout', '') == $layout
) {
return;
}

if (!$found) {
$redirect = true;
}
} else {
if (
$this->input->getCmd('option', '') !== $option || $this->input->getCmd('view', '') !== $view
|| $this->input->getCmd('layout', '') !== $layout
) {
// Requested a different option/view/layout
$redirect = true;
// If the current URL matches an entry in $urls, we do not redirect
foreach ($urls as $url) {
$match = true;

foreach ($url as $key => $value) {
if ($this->input->getCmd($key) !== $value) {
/**
* The current URL does not meet this entry, get out of this loop
* and check next entry
*/
$match = false;
break;
}
}

if ($redirect) {
// Redirect to the profile edit page
$this->enqueueMessage(Text::_('JGLOBAL_PASSWORD_RESET_REQUIRED'), 'notice');
// The current URL meet the entry, no redirect is needed, just return early
if ($match) {
return;
}
}

$url = Route::_('index.php?option=' . $option . '&view=' . $view . '&layout=' . $layout, false);
// Redirect to the profile edit page
$this->enqueueMessage(Text::_('JGLOBAL_PASSWORD_RESET_REQUIRED'), 'notice');

// In the administrator we need a different URL
if (strtolower($name) === 'administrator') {
$user = Factory::getApplication()->getIdentity();
$url = Route::_('index.php?option=' . $option . '&task=' . $view . '.' . $layout . '&id=' . $user->id, false);
}
$url = Route::_('index.php?option=' . $option . '&view=' . $view . '&layout=' . $layout, false);

$this->redirect($url);
}
// In the administrator we need a different URL
if ($this->isClient('administrator')) {
$user = $this->getIdentity();
$url = Route::_(
'index.php?option=' . $option . '&task=' . $view . '.' . $layout . '&id=' . $user->id,
false
);
}

$this->redirect($url);
}

/**
Expand Down
2 changes: 0 additions & 2 deletions libraries/src/Application/SiteApplication.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -265,7 +265,6 @@ protected function doExecute()
['option' => 'com_users', 'view' => 'method'],
['option' => 'com_users', 'task' => 'method.add'],
['option' => 'com_users', 'task' => 'method.save'],
['option' => 'com_users', 'view' => 'profile', 'layout' => 'edit'],
]);
}

Expand Down Expand Up @@ -707,7 +706,6 @@ public function login($credentials, $options = [])
['option' => 'com_users', 'view' => 'method'],
['option' => 'com_users', 'task' => 'method.add'],
['option' => 'com_users', 'task' => 'method.save'],
['option' => 'com_users', 'view' => 'profile', 'layout' => 'edit'],
]);
}

Expand Down