commit ef33d5507f8ae121ccd32f898a4b4182882dce7b parent cddb4b5728dbe36c5135aa6c45d43fc6a5d3b20a Author: Felicitus <felicitus@felicitus.org> Date: Sun, 15 Nov 2015 18:12:15 +0100 Re-implemented the option to prevent a user from changing their password Diffstat:
8 files changed, 59 insertions(+), 6 deletions(-)
diff --git a/src/PartKeepr/AuthBundle/Action/ChangePasswordAction.php b/src/PartKeepr/AuthBundle/Action/ChangePasswordAction.php @@ -6,7 +6,11 @@ use Dunglas\ApiBundle\Action\ActionUtilTrait; use FOS\UserBundle\Model\UserManagerInterface; use FOS\UserBundle\Util\UserManipulator; use PartKeepr\AuthBundle\Entity\User; +use PartKeepr\AuthBundle\Exceptions\OldPasswordWrongException; +use PartKeepr\AuthBundle\Exceptions\PasswordChangeNotAllowedException; use PartKeepr\AuthBundle\Services\UserService; +use Symfony\Component\DependencyInjection\ContainerInterface; +use Symfony\Component\DependencyInjection\ParameterBag\ParameterBagInterface; use Symfony\Component\HttpFoundation\Request; use Symfony\Component\Security\Core\Encoder\EncoderFactory; @@ -34,20 +38,32 @@ class ChangePasswordAction */ private $userManager; + /** + * @var ContainerInterface + */ + private $container; + public function __construct( UserService $userService, UserManipulator $userManipulator, EncoderFactory $encoderFactory, - UserManagerInterface $userManager + UserManagerInterface $userManager, + ContainerInterface $container ) { $this->userService = $userService; $this->userManipulator = $userManipulator; $this->encoderFactory = $encoderFactory; $this->userManager = $userManager; + $this->container = $container; } public function __invoke(Request $request) { + if ($this->container->hasParameter("partkeepr.auth.allow_password_change") && + $this->container->getParameter("partkeepr.auth.allow_password_change") === false) { + throw new PasswordChangeNotAllowedException(); + } + $user = $this->userService->getUser(); if (!$request->request->has("oldpassword") && !$request->request->has("newpassword")) { @@ -61,14 +77,14 @@ class ChangePasswordAction $encoded_pass = $encoder->encodePassword($request->request->get("oldpassword"), $FOSUser->getSalt()); if ($FOSUser->getPassword() != $encoded_pass) { - throw new \Exception("Old password is wrong"); + throw new OldPasswordWrongException(); } $this->userManipulator->changePassword($user->getUsername(), $request->request->get("newpassword")); } else { if ($user->isLegacy()) { if ($user->getPassword() !== md5($request->request->get("oldpassword"))) { - throw new \Exception("Old password is wrong"); + throw new OldPasswordWrongException(); } $user->setNewPassword($request->request->get("newpassword")); diff --git a/src/PartKeepr/AuthBundle/Exceptions/OldPasswordWrongException.php b/src/PartKeepr/AuthBundle/Exceptions/OldPasswordWrongException.php @@ -0,0 +1,15 @@ +<?php +namespace PartKeepr\AuthBundle\Exceptions; + +use PartKeepr\CoreBundle\Exceptions\TranslatableException; + +/** + * Is thrown when the user specified a wrong old password + */ +class OldPasswordWrongException extends TranslatableException +{ + public function getMessageKey() + { + return "Old password is wrong"; + } +} diff --git a/src/PartKeepr/AuthBundle/Exceptions/PasswordChangeNotAllowedException.php b/src/PartKeepr/AuthBundle/Exceptions/PasswordChangeNotAllowedException.php @@ -0,0 +1,15 @@ +<?php +namespace PartKeepr\AuthBundle\Exceptions; + +use PartKeepr\CoreBundle\Exceptions\TranslatableException; + +/** + * Is thrown when the user may not change their password + */ +class PasswordChangeNotAllowedException extends TranslatableException +{ + public function getMessageKey() + { + return "Password change not allowed by the administrator"; + } +} diff --git a/src/PartKeepr/AuthBundle/Exceptions/UserPreferenceNotFoundException.php b/src/PartKeepr/AuthBundle/Exceptions/UserPreferenceNotFoundException.php @@ -4,7 +4,7 @@ namespace PartKeepr\AuthBundle\Exceptions; use PartKeepr\CoreBundle\Exceptions\TranslatableException; /** - * Is thrown when the user has given wrong credentials. + * Is thrown when the user preference couldn't be found */ class UserPreferenceNotFoundException extends TranslatableException { diff --git a/src/PartKeepr/AuthBundle/Resources/config/actions.xml b/src/PartKeepr/AuthBundle/Resources/config/actions.xml @@ -41,6 +41,7 @@ <argument type="service" id="fos_user.util.user_manipulator"/> <argument type="service" id="security.encoder_factory"/> <argument type="service" id="fos_user.user_manager"/> + <argument type="service" id="service_container"/> </service> </services> </container> diff --git a/src/PartKeepr/FrontendBundle/Controller/IndexController.php b/src/PartKeepr/FrontendBundle/Controller/IndexController.php @@ -42,11 +42,13 @@ class IndexController extends Controller $aParameters["motd"] = $this->getParameterWithDefault("partkeepr.frontend.motd", false); } - $aParameters["max_users"] = $this->getParameter("partkeepr.auth.max_users"); + $aParameters["max_users"] = $this->getParameterWithDefault("partkeepr.auth.max_users", "unlimited"); $aParameters["authentication_provider"] = $this->getParameter("partkeepr.authentication_provider"); $aParameters["tip_of_the_day_uri"] = $this->getParameter("partkeepr.tip_of_the_day_uri"); + $aParameters["password_change"] = $this->getParameterWithDefault("partkeepr.auth.allow_password_change", true); + $renderParams = array(); $renderParams["parameters"] = $aParameters; diff --git a/src/PartKeepr/FrontendBundle/Resources/public/js/Components/User/UserPreferences.js b/src/PartKeepr/FrontendBundle/Resources/public/js/Components/User/UserPreferences.js @@ -18,6 +18,10 @@ Ext.define('PartKeepr.UserPreferencePanel', { this.passwordChangePanel, this.stockPanel ]; + + if (PartKeepr.getApplication().getParameter("password_change") === false) { + Ext.Array.remove(this.items, this.passwordChangePanel); + } this.callParent(); }, statics: { diff --git a/src/PartKeepr/FrontendBundle/Resources/public/js/PartKeepr.js b/src/PartKeepr/FrontendBundle/Resources/public/js/PartKeepr.js @@ -69,7 +69,7 @@ Ext.application({ }, getParameter: function (parameter) { - if (window.parameters[parameter]) { + if (window.parameters[parameter] !== undefined) { return window.parameters[parameter]; } },