Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[5.2] Fix password reset broken in backend #44723

Merged
merged 4 commits into from
Jan 18, 2025
Merged
Show file tree
Hide file tree
Changes from 2 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
114 changes: 57 additions & 57 deletions libraries/src/Application/CMSApplication.php
Original file line number Diff line number Diff line change
Expand Up @@ -406,74 +406,74 @@ protected function checkUserRequireReset($option, $view, $layout, $tasks)
*/
protected function checkUserRequiresReset($option, $view, $layout, $urls = [])
{
if ($this->getIdentity()->requireReset) {
$redirect = false;

/*
* By default user profile edit page is used.
* That page allows you to change more than just the password and might not be the desired behavior.
* This allows a developer to override the page that manage the password reset.
* (can be configured using the file: configuration.php, or if extended, through the global configuration form)
*/
$name = $this->getName();

if ($this->get($name . '_reset_password_override', 0)) {
$option = $this->get($name . '_reset_password_option', '');
$view = $this->get($name . '_reset_password_view', '');
$layout = $this->get($name . '_reset_password_layout', '');
$urls = $this->get($name . '_reset_password_urls', $urls);
}

// If the current URL matches an entry in $urls, we do not redirect
if (\count($urls)) {
$found = false;

foreach ($urls as $url) {
$found2 = false;
// Password reset is not required for the user, no need to check it further
if (!$this->getIdentity()->requireReset) {
return;
}

foreach ($url as $key => $value) {
if ($this->input->getCmd($key) !== $value) {
$found2 = false;
break;
}
/*
* By default user profile edit page is used.
* That page allows you to change more than just the password and might not be the desired behavior.
* This allows a developer to override the page that manage the password reset.
* (can be configured using the file: configuration.php, or if extended, through the global configuration form)
*/
$name = $this->getName();

$found2 = true;
}
if ($this->get($name . '_reset_password_override', 0)) {
$option = $this->get($name . '_reset_password_option', '');
$view = $this->get($name . '_reset_password_view', '');
$layout = $this->get($name . '_reset_password_layout', '');
$urls = $this->get($name . '_reset_password_urls', $urls);
}

if ($found2) {
$found = true;
break;
}
}
/**
* The page which manage password reset always need to accessible, so if the current page
* is managing password reset page, no need to check it further
*/
if (
$this->input->getCmd('option', '') === $option
&& $this->input->getCmd('view', '') === $view
&& $this->input->getCmd('layout', '') == $layout
) {
return;
}

if (!$found) {
$redirect = true;
}
} else {
if (
$this->input->getCmd('option', '') !== $option || $this->input->getCmd('view', '') !== $view
|| $this->input->getCmd('layout', '') !== $layout
) {
// Requested a different option/view/layout
$redirect = true;
// If the current URL matches an entry in $urls, we do not redirect
foreach ($urls as $url) {
$match = true;

foreach ($url as $key => $value) {
if ($this->input->getCmd($key) !== $value) {
/**
* The current URL does not meet this entry, get out of this loop
* and check next entry
*/
$match = false;
break;
}
}

if ($redirect) {
// Redirect to the profile edit page
$this->enqueueMessage(Text::_('JGLOBAL_PASSWORD_RESET_REQUIRED'), 'notice');
// The current URL meet the entry, no redirect is needed, just return early
if ($match) {
return;
}
}

$url = Route::_('index.php?option=' . $option . '&view=' . $view . '&layout=' . $layout, false);
// Redirect to the profile edit page
$this->enqueueMessage(Text::_('JGLOBAL_PASSWORD_RESET_REQUIRED'), 'notice');

// In the administrator we need a different URL
if (strtolower($name) === 'administrator') {
$user = Factory::getApplication()->getIdentity();
$url = Route::_('index.php?option=' . $option . '&task=' . $view . '.' . $layout . '&id=' . $user->id, false);
}
$url = Route::_('index.php?option=' . $option . '&view=' . $view . '&layout=' . $layout, false);

$this->redirect($url);
}
// In the administrator we need a different URL
if (strtolower($name) === 'administrator') {
$user = Factory::getApplication()->getIdentity();
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is from existing code. But anyone knows why do we have to use Factory::getApplication()->getIdentity(); instead of $this->getIdentity(); here?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It was written like that 6 years ago and I would say it is an oversight. Please change it to $this->getIdentity()

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Hackwar I am also thinking about changing if (strtolower($name) === 'administrator') to if ($this->isClient('administrator')) . How do you think about it?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK. I made the discussed changes

$url = Route::_(
'index.php?option=' . $option . '&task=' . $view . '.' . $layout . '&id=' . $user->id,
false
);
}

$this->redirect($url);
}

/**
Expand Down
2 changes: 0 additions & 2 deletions libraries/src/Application/SiteApplication.php
Original file line number Diff line number Diff line change
Expand Up @@ -265,7 +265,6 @@ protected function doExecute()
['option' => 'com_users', 'view' => 'method'],
['option' => 'com_users', 'task' => 'method.add'],
['option' => 'com_users', 'task' => 'method.save'],
['option' => 'com_users', 'view' => 'profile', 'layout' => 'edit'],
]);
}

Expand Down Expand Up @@ -707,7 +706,6 @@ public function login($credentials, $options = [])
['option' => 'com_users', 'view' => 'method'],
['option' => 'com_users', 'task' => 'method.add'],
['option' => 'com_users', 'task' => 'method.save'],
['option' => 'com_users', 'view' => 'profile', 'layout' => 'edit'],
]);
}

Expand Down