Skip to content

Commit 7a67ac9

Browse files
omiroshnichenkoomiroshnichenko
committed
MAGETWO-59090: [Github] Admin can't reset password for more than one customer #5260 
1 parent aef25e7 commit 7a67ac9

File tree

5 files changed

+157
-3
lines changed

5 files changed

+157
-3
lines changed

‎app/code/Magento/Customer/Controller/Adminhtml/Index/ResetPassword.php

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
namespace Magento\Customer\Controller\Adminhtml\Index;
77

88
use Magento\Framework\Exception\NoSuchEntityException;
9+
use Magento\Framework\Exception\SecurityViolationException;
910

1011
class ResetPassword extends \Magento\Customer\Controller\Adminhtml\Index
1112
{
@@ -40,6 +41,8 @@ public function execute()
4041
$messages = $exception->getMessage();
4142
}
4243
$this->_addSessionErrorMessages($messages);
44+
} catch (SecurityViolationException $exception) {
45+
$this->messageManager->addErrorMessage($exception->getMessage());
4346
} catch (\Exception $exception) {
4447
$this->messageManager->addException(
4548
$exception,

‎app/code/Magento/Customer/Test/Unit/Controller/Adminhtml/Index/ResetPasswordTest.php

Lines changed: 51 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -143,7 +143,7 @@ protected function setUp()
143143
$this->messageManager = $this->getMockBuilder(
144144
\Magento\Framework\Message\Manager::class
145145
)->disableOriginalConstructor()->setMethods(
146-
['addSuccess', 'addMessage', 'addException']
146+
['addSuccess', 'addMessage', 'addException', 'addErrorMessage']
147147
)->getMock();
148148

149149
$this->resultRedirectFactoryMock = $this->getMockBuilder(
@@ -332,6 +332,56 @@ public function testResetPasswordActionCoreException()
332332
$this->_testedObject->execute();
333333
}
334334

335+
public function testResetPasswordActionSecurityException()
336+
{
337+
$securityText = 'Security violation.';
338+
$exception = new \Magento\Framework\Exception\SecurityViolationException(__($securityText));
339+
$customerId = 1;
340+
$email = 'some@example.com';
341+
$websiteId = 1;
342+
343+
$this->_request->expects(
344+
$this->once()
345+
)->method(
346+
'getParam'
347+
)->with(
348+
$this->equalTo('customer_id'),
349+
$this->equalTo(0)
350+
)->will(
351+
$this->returnValue($customerId)
352+
);
353+
$customer = $this->getMockForAbstractClass(
354+
\Magento\Customer\Api\Data\CustomerInterface::class,
355+
['getId', 'getEmail', 'getWebsiteId']
356+
);
357+
$customer->expects($this->once())->method('getEmail')->will($this->returnValue($email));
358+
$customer->expects($this->once())->method('getWebsiteId')->will($this->returnValue($websiteId));
359+
$this->_customerRepositoryMock->expects(
360+
$this->once()
361+
)->method(
362+
'getById'
363+
)->with(
364+
$customerId
365+
)->will(
366+
$this->returnValue($customer)
367+
);
368+
$this->_customerAccountManagementMock->expects(
369+
$this->once()
370+
)->method(
371+
'initiatePasswordReset'
372+
)->willThrowException($exception);
373+
374+
$this->messageManager->expects(
375+
$this->once()
376+
)->method(
377+
'addErrorMessage'
378+
)->with(
379+
$this->equalTo($exception->getMessage())
380+
);
381+
382+
$this->_testedObject->execute();
383+
}
384+
335385
public function testResetPasswordActionCoreExceptionWarn()
336386
{
337387
$warningText = 'Warning';

‎app/code/Magento/Security/Model/Plugin/AccountManagement.php

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,18 +25,26 @@ class AccountManagement
2525
*/
2626
protected $securityManager;
2727

28+
/**
29+
* @var int
30+
*/
31+
protected $passwordRequestEvent;
32+
2833
/**
2934
* AccountManagement constructor.
3035
*
3136
* @param \Magento\Framework\App\RequestInterface $request
3237
* @param SecurityManager $securityManager
38+
* @param int $passwordRequestEvent
3339
*/
3440
public function __construct(
3541
\Magento\Framework\App\RequestInterface $request,
36-
\Magento\Security\Model\SecurityManager $securityManager
42+
\Magento\Security\Model\SecurityManager $securityManager,
43+
$passwordRequestEvent = PasswordResetRequestEvent::CUSTOMER_PASSWORD_RESET_REQUEST
3744
) {
3845
$this->request = $request;
3946
$this->securityManager = $securityManager;
47+
$this->passwordRequestEvent = $passwordRequestEvent;
4048
}
4149

4250
/**
@@ -56,7 +64,7 @@ public function beforeInitiatePasswordReset(
5664
$websiteId = null
5765
) {
5866
$this->securityManager->performSecurityCheck(
59-
PasswordResetRequestEvent::CUSTOMER_PASSWORD_RESET_REQUEST,
67+
$this->passwordRequestEvent,
6068
$email
6169
);
6270
return [$email, $template, $websiteId];

‎app/code/Magento/Security/etc/adminhtml/di.xml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,11 @@
1515
<type name="Magento\Backend\Controller\Adminhtml\Auth\Login">
1616
<plugin name="security_login_form" type="Magento\Security\Model\Plugin\LoginController" />
1717
</type>
18+
<type name="Magento\Security\Model\Plugin\AccountManagement">
19+
<arguments>
20+
<argument name="passwordRequestEvent" xsi:type="const">Magento\Security\Model\PasswordResetRequestEvent::ADMIN_PASSWORD_RESET_REQUEST</argument>
21+
</arguments>
22+
</type>
1823
<type name="Magento\Security\Model\SecurityManager">
1924
<arguments>
2025
<argument name="securityCheckers" xsi:type="array">

‎dev/tests/integration/testsuite/Magento/Customer/Controller/Adminhtml/Index/ResetPasswordTest.php

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
<?php
2+
/**
3+
* Copyright © 2016 Magento. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
namespace Magento\Customer\Controller\Adminhtml\Index;
7+
8+
/**
9+
* ResetPassword controller test.
10+
*
11+
* @magentoAppArea adminhtml
12+
*/
13+
class ResetPasswordTest extends \Magento\TestFramework\TestCase\AbstractBackendController
14+
{
15+
/**
16+
* Base controller URL
17+
*
18+
* @var string
19+
*/
20+
protected $baseControllerUrl = 'http://localhost/index.php/backend/customer/index/';
21+
22+
/**
23+
* Checks reset password functionality with default settings and customer reset request event.
24+
*
25+
* @magentoConfigFixture current_store admin/security/limit_password_reset_requests_method 1
26+
* @magentoConfigFixture current_store admin/security/min_time_between_password_reset_requests 10
27+
* @magentoDataFixture Magento/Customer/_files/customer.php
28+
*/
29+
public function testResetPasswordSuccess()
30+
{
31+
$this->passwordResetRequestEventCreate(
32+
\Magento\Security\Model\PasswordResetRequestEvent::CUSTOMER_PASSWORD_RESET_REQUEST
33+
);
34+
$this->getRequest()->setPostValue(['customer_id' => '1']);
35+
$this->dispatch('backend/customer/index/resetPassword');
36+
$this->assertSessionMessages(
37+
$this->equalTo(['The customer will receive an email with a link to reset password.']),
38+
\Magento\Framework\Message\MessageInterface::TYPE_SUCCESS
39+
);
40+
$this->assertRedirect($this->stringStartsWith($this->baseControllerUrl . 'edit'));
41+
}
42+
43+
/**
44+
* Checks reset password functionality with default settings, customer and admin reset request events.
45+
*
46+
* @magentoConfigFixture current_store admin/security/limit_password_reset_requests_method 1
47+
* @magentoConfigFixture current_store admin/security/min_time_between_password_reset_requests 10
48+
* @magentoConfigFixture current_store contact/email/recipient_email hello@example.com
49+
* @magentoDataFixture Magento/Customer/_files/customer.php
50+
*/
51+
public function testResetPasswordWithSecurityViolationException()
52+
{
53+
$this->passwordResetRequestEventCreate(
54+
\Magento\Security\Model\PasswordResetRequestEvent::CUSTOMER_PASSWORD_RESET_REQUEST
55+
);
56+
$this->passwordResetRequestEventCreate(
57+
\Magento\Security\Model\PasswordResetRequestEvent::ADMIN_PASSWORD_RESET_REQUEST
58+
);
59+
$this->getRequest()->setPostValue(['customer_id' => '1']);
60+
$this->dispatch('backend/customer/index/resetPassword');
61+
$this->assertSessionMessages(
62+
$this->equalTo(
63+
['Too many password reset requests. Please wait and try again or contact hello@example.com.']
64+
),
65+
\Magento\Framework\Message\MessageInterface::TYPE_ERROR
66+
);
67+
$this->assertRedirect($this->stringStartsWith($this->baseControllerUrl . 'edit'));
68+
}
69+
70+
/**
71+
* Create and save reset request event with provided request type.
72+
*
73+
* @param int $requestType
74+
*/
75+
private function passwordResetRequestEventCreate($requestType)
76+
{
77+
$passwordResetRequestEventFactory = $this->_objectManager->get(
78+
\Magento\Security\Model\PasswordResetRequestEventFactory::class
79+
);
80+
$passwordResetRequestEvent = $passwordResetRequestEventFactory->create();
81+
$passwordResetRequestEvent
82+
->setRequestType($requestType)
83+
->setAccountReference('customer@example.com')
84+
->setCreatedAt(strtotime('now'))
85+
->setIp('3232249856')
86+
->save();
87+
}
88+
}

0 commit comments

Comments
 (0)