Same name and namespace in other branches

1. 9 core/modules/user/src/Controller/UserController.php \Drupal\user\Controller\UserController::resetPassLogin()
2. 10 core/modules/user/src/Controller/UserController.php \Drupal\user\Controller\UserController::resetPassLogin()
3. 11.x core/modules/user/src/Controller/UserController.php \Drupal\user\Controller\UserController::resetPassLogin()

Validates user, hash, and timestamp; logs the user in if correct.

Parameters

int $uid: User ID of the user requesting reset.

int $timestamp: The current timestamp.

string $hash: Login link hash.

Return value

\Symfony\Component\HttpFoundation\RedirectResponse Returns a redirect to the user edit form if the information is correct. If the information is incorrect redirects to 'user.pass' route with a message for the user.

Throws

\Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException If $uid is for a blocked user or invalid user ID.

1 string reference to 'UserController::resetPassLogin'

user.routing.yml in core/modules/user/user.routing.yml

core/modules/user/user.routing.yml

File

core/modules/user/src/Controller/UserController.php, line 226

Class

UserController

Controller routines for user routes.

Namespace

Drupal\user\Controller

Code

public function resetPassLogin($uid, $timestamp, $hash) {
  // The current user is not logged in, so check the parameters.
  $current = REQUEST_TIME;
  /** @var \Drupal\user\UserInterface $user */
  $user = $this->userStorage
    ->load($uid);
  // Verify that the user exists and is active.
  if ($user === NULL || !$user->isActive()) {
    // Blocked or invalid user ID, so deny access. The parameters will be in
    // the watchdog's URL for the administrator to check.
    throw new AccessDeniedHttpException();
  }
  // Time out, in seconds, until login URL expires.
  $timeout = $this->config('user.settings')
    ->get('password_reset_timeout');
  // No time out for first time login.
  if ($user->getLastLoginTime() && $current - $timestamp > $timeout) {
    $this->messenger()
      ->addError($this->t('You have tried to use a one-time login link that has expired. Please request a new one using the form below.'));
    return $this->redirect('user.pass');
  }
  elseif ($user->isAuthenticated() && $timestamp >= $user->getLastLoginTime() && $timestamp <= $current && hash_equals($hash, user_pass_rehash($user, $timestamp))) {
    user_login_finalize($user);
    $this->logger
      ->notice('User %name used one-time login link at time %timestamp.', [
      '%name' => $user->getDisplayName(),
      '%timestamp' => $timestamp,
    ]);
    $this->messenger()
      ->addStatus($this->t('You have just used your one-time login link. It is no longer necessary to use this link to log in. Please change your password.'));
    // Let the user's password be changed without the current password
    // check.
    $token = Crypt::randomBytesBase64(55);
    $_SESSION['pass_reset_' . $user->id()] = $token;
    // Clear any flood events for this user.
    $this->flood
      ->clear('user.password_request_user', $uid);
    return $this->redirect('entity.user.edit_form', [
      'user' => $user->id(),
    ], [
      'query' => [
        'pass-reset-token' => $token,
      ],
      'absolute' => TRUE,
    ]);
  }
  $this->messenger()
    ->addError($this->t('You have tried to use a one-time login link that has either been used or is no longer valid. Please request a new one using the form below.'));
  return $this->redirect('user.pass');
}

---