Skip to content

Commit 3a35b6e

Browse files
SeruyVSeruyV
committed
MC-38676: Fixed force logout after email change
1 parent 9a35dad commit 3a35b6e

File tree

2 files changed

+98
-27
lines changed

2 files changed

+98
-27
lines changed

‎app/code/Magento/Customer/Controller/Account/EditPost.php

Lines changed: 38 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,9 @@
77

88
namespace Magento\Customer\Controller\Account;
99

10+
use Exception;
1011
use Magento\Customer\Api\Data\CustomerInterface;
12+
use Magento\Customer\Api\SessionCleanerInterface;
1113
use Magento\Customer\Model\AddressRegistry;
1214
use Magento\Framework\App\Action\HttpPostActionInterface as HttpPostActionInterface;
1315
use Magento\Customer\Model\AuthenticationInterface;
@@ -27,13 +29,15 @@
2729
use Magento\Framework\Escaper;
2830
use Magento\Framework\Exception\InputException;
2931
use Magento\Framework\Exception\InvalidEmailOrPasswordException;
32+
use Magento\Framework\Exception\LocalizedException;
3033
use Magento\Framework\Exception\NoSuchEntityException;
3134
use Magento\Framework\Exception\State\UserLockedException;
3235
use Magento\Customer\Controller\AbstractAccount;
3336
use Magento\Framework\Phrase;
3437

3538
/**
36-
* Class EditPost
39+
* Customer edit page.
40+
*
3741
* @SuppressWarnings(PHPMD.CouplingBetweenObjects)
3842
*/
3943
class EditPost extends AbstractAccount implements CsrfAwareActionInterface, HttpPostActionInterface
@@ -69,7 +73,7 @@ class EditPost extends AbstractAccount implements CsrfAwareActionInterface, Http
6973
protected $session;
7074

7175
/**
72-
* @var \Magento\Customer\Model\EmailNotificationInterface
76+
* @var EmailNotificationInterface
7377
*/
7478
private $emailNotification;
7579

@@ -93,6 +97,11 @@ class EditPost extends AbstractAccount implements CsrfAwareActionInterface, Http
9397
*/
9498
private $addressRegistry;
9599

100+
/**
101+
* @var SessionCleanerInterface|null
102+
*/
103+
private $sessionCleaner;
104+
96105
/**
97106
* @param Context $context
98107
* @param Session $customerSession
@@ -102,6 +111,7 @@ class EditPost extends AbstractAccount implements CsrfAwareActionInterface, Http
102111
* @param CustomerExtractor $customerExtractor
103112
* @param Escaper|null $escaper
104113
* @param AddressRegistry|null $addressRegistry
114+
* @param SessionCleanerInterface|null $sessionCleaner
105115
*/
106116
public function __construct(
107117
Context $context,
@@ -111,7 +121,8 @@ public function __construct(
111121
Validator $formKeyValidator,
112122
CustomerExtractor $customerExtractor,
113123
?Escaper $escaper = null,
114-
AddressRegistry $addressRegistry = null
124+
AddressRegistry $addressRegistry = null,
125+
?SessionCleanerInterface $sessionCleaner = null
115126
) {
116127
parent::__construct($context);
117128
$this->session = $customerSession;
@@ -121,6 +132,7 @@ public function __construct(
121132
$this->customerExtractor = $customerExtractor;
122133
$this->escaper = $escaper ?: ObjectManager::getInstance()->get(Escaper::class);
123134
$this->addressRegistry = $addressRegistry ?: ObjectManager::getInstance()->get(AddressRegistry::class);
135+
$this->sessionCleaner = $sessionCleaner ?: ObjectManager::getInstance()->get(SessionCleanerInterface::class);
124136
}
125137

126138
/**
@@ -132,9 +144,7 @@ private function getAuthentication()
132144
{
133145

134146
if (!($this->authentication instanceof AuthenticationInterface)) {
135-
return ObjectManager::getInstance()->get(
136-
\Magento\Customer\Model\AuthenticationInterface::class
137-
);
147+
return ObjectManager::getInstance()->get(AuthenticationInterface::class);
138148
} else {
139149
return $this->authentication;
140150
}
@@ -149,9 +159,7 @@ private function getAuthentication()
149159
private function getEmailNotification()
150160
{
151161
if (!($this->emailNotification instanceof EmailNotificationInterface)) {
152-
return ObjectManager::getInstance()->get(
153-
EmailNotificationInterface::class
154-
);
162+
return ObjectManager::getInstance()->get(EmailNotificationInterface::class);
155163
} else {
156164
return $this->emailNotification;
157165
}
@@ -160,9 +168,8 @@ private function getEmailNotification()
160168
/**
161169
* @inheritDoc
162170
*/
163-
public function createCsrfValidationException(
164-
RequestInterface $request
165-
): ?InvalidRequestException {
171+
public function createCsrfValidationException(RequestInterface $request): ?InvalidRequestException
172+
{
166173
/** @var Redirect $resultRedirect */
167174
$resultRedirect = $this->resultRedirectFactory->create();
168175
$resultRedirect->setPath('*/*/edit');
@@ -184,11 +191,11 @@ public function validateForCsrf(RequestInterface $request): ?bool
184191
/**
185192
* Change customer email or password action
186193
*
187-
* @return \Magento\Framework\Controller\Result\Redirect
194+
* @return Redirect
188195
*/
189196
public function execute()
190197
{
191-
/** @var \Magento\Framework\Controller\Result\Redirect $resultRedirect */
198+
/** @var Redirect $resultRedirect */
192199
$resultRedirect = $this->resultRedirectFactory->create();
193200
$validFormKey = $this->formKeyValidator->validate($this->getRequest());
194201

@@ -217,6 +224,7 @@ public function execute()
217224
);
218225
$this->dispatchSuccessEvent($customerCandidateDataObject);
219226
$this->messageManager->addSuccessMessage(__('You saved the account information.'));
227+
220228
return $resultRedirect->setPath('customer/account');
221229
} catch (InvalidEmailOrPasswordException $e) {
222230
$this->messageManager->addErrorMessage($this->escaper->escapeHtml($e->getMessage()));
@@ -228,15 +236,16 @@ public function execute()
228236
$this->session->logout();
229237
$this->session->start();
230238
$this->messageManager->addErrorMessage($message);
239+
231240
return $resultRedirect->setPath('customer/account/login');
232241
} catch (InputException $e) {
233242
$this->messageManager->addErrorMessage($this->escaper->escapeHtml($e->getMessage()));
234243
foreach ($e->getErrors() as $error) {
235244
$this->messageManager->addErrorMessage($this->escaper->escapeHtml($error->getMessage()));
236245
}
237-
} catch (\Magento\Framework\Exception\LocalizedException $e) {
246+
} catch (LocalizedException $e) {
238247
$this->messageManager->addErrorMessage($e->getMessage());
239-
} catch (\Exception $e) {
248+
} catch (Exception $e) {
240249
$this->messageManager->addException($e, __('We can\'t save the customer.'));
241250
}
242251

@@ -246,16 +255,17 @@ public function execute()
246255
/** @var Redirect $resultRedirect */
247256
$resultRedirect = $this->resultRedirectFactory->create();
248257
$resultRedirect->setPath('*/*/edit');
258+
249259
return $resultRedirect;
250260
}
251261

252262
/**
253263
* Account editing action completed successfully event
254264
*
255-
* @param \Magento\Customer\Api\Data\CustomerInterface $customerCandidateDataObject
265+
* @param CustomerInterface $customerCandidateDataObject
256266
* @return void
257267
*/
258-
private function dispatchSuccessEvent(\Magento\Customer\Api\Data\CustomerInterface $customerCandidateDataObject)
268+
private function dispatchSuccessEvent(CustomerInterface $customerCandidateDataObject)
259269
{
260270
$this->_eventManager->dispatch(
261271
'customer_account_edited',
@@ -268,7 +278,7 @@ private function dispatchSuccessEvent(\Magento\Customer\Api\Data\CustomerInterfa
268278
*
269279
* @param int $customerId
270280
*
271-
* @return \Magento\Customer\Api\Data\CustomerInterface
281+
* @return CustomerInterface
272282
*/
273283
private function getCustomerDataObject($customerId)
274284
{
@@ -278,13 +288,13 @@ private function getCustomerDataObject($customerId)
278288
/**
279289
* Create Data Transfer Object of customer candidate
280290
*
281-
* @param \Magento\Framework\App\RequestInterface $inputData
282-
* @param \Magento\Customer\Api\Data\CustomerInterface $currentCustomerData
283-
* @return \Magento\Customer\Api\Data\CustomerInterface
291+
* @param RequestInterface $inputData
292+
* @param CustomerInterface $currentCustomerData
293+
* @return CustomerInterface
284294
*/
285295
private function populateNewCustomerDataObject(
286-
\Magento\Framework\App\RequestInterface $inputData,
287-
\Magento\Customer\Api\Data\CustomerInterface $currentCustomerData
296+
RequestInterface $inputData,
297+
CustomerInterface $currentCustomerData
288298
) {
289299
$attributeValues = $this->getCustomerMapper()->toFlatArray($currentCustomerData);
290300
$customerDto = $this->customerExtractor->extract(
@@ -330,12 +340,12 @@ protected function changeCustomerPassword($email)
330340
/**
331341
* Process change email request
332342
*
333-
* @param \Magento\Customer\Api\Data\CustomerInterface $currentCustomerDataObject
343+
* @param CustomerInterface $currentCustomerDataObject
334344
* @return void
335345
* @throws InvalidEmailOrPasswordException
336346
* @throws UserLockedException
337347
*/
338-
private function processChangeEmailRequest(\Magento\Customer\Api\Data\CustomerInterface $currentCustomerDataObject)
348+
private function processChangeEmailRequest(CustomerInterface $currentCustomerDataObject)
339349
{
340350
if ($this->getRequest()->getParam('change_email')) {
341351
// authenticate user for changing email
@@ -344,6 +354,7 @@ private function processChangeEmailRequest(\Magento\Customer\Api\Data\CustomerIn
344354
$currentCustomerDataObject->getId(),
345355
$this->getRequest()->getPost('current_password')
346356
);
357+
$this->sessionCleaner->clearFor($currentCustomerDataObject->getId());
347358
} catch (InvalidEmailOrPasswordException $e) {
348359
throw new InvalidEmailOrPasswordException(
349360
__("The password doesn't match this account. Verify the password and try again.")
@@ -362,7 +373,7 @@ private function processChangeEmailRequest(\Magento\Customer\Api\Data\CustomerIn
362373
private function getCustomerMapper()
363374
{
364375
if ($this->customerMapper === null) {
365-
$this->customerMapper = ObjectManager::getInstance()->get(\Magento\Customer\Model\Customer\Mapper::class);
376+
$this->customerMapper = ObjectManager::getInstance()->get(Mapper::class);
366377
}
367378
return $this->customerMapper;
368379
}

‎app/code/Magento/Customer/Test/Mftf/Test/StorefrontChangeCustomerEmailTest.xml

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
/**
4+
* Copyright © Magento, Inc. All rights reserved.
5+
* See COPYING.txt for license details.
6+
*/
7+
-->
8+
9+
<tests xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
10+
xsi:noNamespaceSchemaLocation="urn:magento:mftf:Test/etc/testSchema.xsd">
11+
<test name="StorefrontChangeCustomerEmailTest">
12+
<annotations>
13+
<features value="Customer"/>
14+
<stories value="Update Customer"/>
15+
<title value="Changing Customer Email Test"/>
16+
<description value="Changing Customer's email with correct and wrong passwords"/>
17+
<testCaseId value="MC-38725"/>
18+
<severity value="MAJOR"/>
19+
<group value="customer"/>
20+
</annotations>
21+
<before>
22+
<createData entity="Simple_US_Customer" stepKey="customer"/>
23+
</before>
24+
<after>
25+
<deleteData createDataKey="customer" stepKey="deleteCustomer"/>
26+
</after>
27+
28+
<actionGroup ref="StorefrontOpenHomePageActionGroup" stepKey="openStorefrontHomePage"/>
29+
<actionGroup ref="LoginToStorefrontActionGroup" stepKey="loginToStorefrontAccount">
30+
<argument name="Customer" value="$customer$"/>
31+
</actionGroup>
32+
<!-- Navigate to "Account Information" tab First Time-->
33+
<actionGroup ref="StorefrontOpenCustomerAccountInfoEditPageActionGroup" stepKey="goToCustomerEditPageFirstTime"/>
34+
<!-- Entering new email, saving with correct password -->
35+
<actionGroup ref="StorefrontCustomerChangeEmailActionGroup" stepKey="changeEmailCorrectAttempt">
36+
<argument name="email" value="$customer.email$"/>
37+
<argument name="password" value="$customer.password$"/>
38+
</actionGroup>
39+
<!-- See Success Notify, check that customer was force logged out -->
40+
<actionGroup ref="AssertMessageCustomerChangeAccountInfoActionGroup" stepKey="seeSuccessMessage">
41+
<argument name="message" value="You saved the account information."/>
42+
</actionGroup>
43+
<see userInput="Default welcome msg!" selector="{{StorefrontPanelHeaderSection.WelcomeMessage}}" stepKey="assertWelcomeMessage"/>
44+
<actionGroup ref="LoginToStorefrontActionGroup" stepKey="loginToStorefrontAccountAfterEmailChange">
45+
<argument name="Customer" value="$customer$"/>
46+
</actionGroup>
47+
<!-- Navigate to "Account Information" tab Second Time-->
48+
<actionGroup ref="StorefrontOpenCustomerAccountInfoEditPageActionGroup" stepKey="goToCustomerEditPageSecondTime" />
49+
<!-- Checking Email checkbox, entering new email, saving with incorrect password -->
50+
<actionGroup ref="StorefrontCustomerChangeEmailActionGroup" stepKey="changeEmailWrongAttempt">
51+
<argument name="email" value="$customer.email$"/>
52+
<argument name="password" value="WRONG_PASSWORD_123123q"/>
53+
</actionGroup>
54+
<!-- See Failure Message-->
55+
<actionGroup ref="AssertMessageCustomerChangeAccountInfoActionGroup" stepKey="seeFailureMessage">
56+
<argument name="message" value="The password doesn't match this account. Verify the password and try again."/>
57+
<argument name="messageType" value="error"/>
58+
</actionGroup>
59+
</test>
60+
</tests>

0 commit comments

Comments
 (0)