Skip to content

Commit 8dfaa62

Browse files
dvoskoboinikovdvoskoboinikov
authored
Merge pull request #2682 from magento-qwerty/2.2.6-bugfixes
Fixed issues: - MAGETWO-72982: [Backport for 2.2.x] Reset Password - MAGETWO-88598: [Backport for 2.2.x] Varnish Config Access List - MAGETWO-88604: [Backport for 2.2.x] Invalid Video Uploader Link - MAGETWO-72024: [Backport for 2.2.x] Wysiwyg editor incorrectly processes attributes of HTML5 tags
2 parents e697bc4 + f24b830 commit 8dfaa62

File tree

17 files changed

+333
-2698
lines changed

17 files changed

+333
-2698
lines changed

‎app/code/Magento/Customer/Api/AccountManagementInterface.php

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@
77

88
namespace Magento\Customer\Api;
99

10+
use Magento\Framework\Exception\InputException;
11+
1012
/**
1113
* Interface for managing customers accounts.
1214
* @api
@@ -144,19 +146,24 @@ public function initiatePasswordReset($email, $template, $websiteId = null);
144146
/**
145147
* Reset customer password.
146148
*
147-
* @param string $email
149+
* @param string $email If empty value given then the customer
150+
* will be matched by the RP token.
148151
* @param string $resetToken
149152
* @param string $newPassword
153+
*
150154
* @return bool true on success
151155
* @throws \Magento\Framework\Exception\LocalizedException
156+
* @throws InputException
152157
*/
153158
public function resetPassword($email, $resetToken, $newPassword);
154159

155160
/**
156161
* Check if password reset token is valid.
157162
*
158-
* @param int $customerId
163+
* @param int $customerId If 0 is given then a customer
164+
* will be matched by the RP token.
159165
* @param string $resetPasswordLinkToken
166+
*
160167
* @return bool True if the token is valid
161168
* @throws \Magento\Framework\Exception\State\InputMismatchException If token is mismatched
162169
* @throws \Magento\Framework\Exception\State\ExpiredException If token is expired

‎app/code/Magento/Customer/Controller/Account/CreatePassword.php

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -54,27 +54,30 @@ public function __construct(
5454
public function execute()
5555
{
5656
$resetPasswordToken = (string)$this->getRequest()->getParam('token');
57-
$customerId = (int)$this->getRequest()->getParam('id');
58-
$isDirectLink = $resetPasswordToken != '' && $customerId != 0;
57+
$isDirectLink = $resetPasswordToken != '';
5958
if (!$isDirectLink) {
6059
$resetPasswordToken = (string)$this->session->getRpToken();
61-
$customerId = (int)$this->session->getRpCustomerId();
6260
}
6361

6462
try {
65-
$this->accountManagement->validateResetPasswordLinkToken($customerId, $resetPasswordToken);
63+
$this->accountManagement->validateResetPasswordLinkToken(
64+
0,
65+
$resetPasswordToken
66+
);
6667

6768
if ($isDirectLink) {
6869
$this->session->setRpToken($resetPasswordToken);
69-
$this->session->setRpCustomerId($customerId);
7070
$resultRedirect = $this->resultRedirectFactory->create();
7171
$resultRedirect->setPath('*/*/createpassword');
72+
7273
return $resultRedirect;
7374
} else {
7475
/** @var \Magento\Framework\View\Result\Page $resultPage */
7576
$resultPage = $this->resultPageFactory->create();
76-
$resultPage->getLayout()->getBlock('resetPassword')->setCustomerId($customerId)
77+
$resultPage->getLayout()
78+
->getBlock('resetPassword')
7779
->setResetPasswordLinkToken($resetPasswordToken);
80+
7881
return $resultPage;
7982
}
8083
} catch (\Exception $exception) {

‎app/code/Magento/Customer/Controller/Account/ResetPasswordPost.php

Lines changed: 20 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@
1212
use Magento\Framework\App\Action\Context;
1313
use Magento\Framework\Exception\InputException;
1414
use Magento\Customer\Model\Customer\CredentialsValidator;
15-
use Magento\Framework\App\ObjectManager;
1615

1716
class ResetPasswordPost extends \Magento\Customer\Controller\AbstractAccount
1817
{
@@ -31,17 +30,14 @@ class ResetPasswordPost extends \Magento\Customer\Controller\AbstractAccount
3130
*/
3231
protected $session;
3332

34-
/**
35-
* @var CredentialsValidator
36-
*/
37-
private $credentialsValidator;
38-
3933
/**
4034
* @param Context $context
4135
* @param Session $customerSession
4236
* @param AccountManagementInterface $accountManagement
4337
* @param CustomerRepositoryInterface $customerRepository
4438
* @param CredentialsValidator|null $credentialsValidator
39+
*
40+
* @SuppressWarnings(PHPMD.UnusedFormalParameter)
4541
*/
4642
public function __construct(
4743
Context $context,
@@ -53,8 +49,6 @@ public function __construct(
5349
$this->session = $customerSession;
5450
$this->accountManagement = $accountManagement;
5551
$this->customerRepository = $customerRepository;
56-
$this->credentialsValidator = $credentialsValidator ?: ObjectManager::getInstance()
57-
->get(CredentialsValidator::class);
5852
parent::__construct($context);
5953
}
6054

@@ -70,27 +64,33 @@ public function execute()
7064
/** @var \Magento\Framework\Controller\Result\Redirect $resultRedirect */
7165
$resultRedirect = $this->resultRedirectFactory->create();
7266
$resetPasswordToken = (string)$this->getRequest()->getQuery('token');
73-
$customerId = (int)$this->getRequest()->getQuery('id');
7467
$password = (string)$this->getRequest()->getPost('password');
7568
$passwordConfirmation = (string)$this->getRequest()->getPost('password_confirmation');
7669

7770
if ($password !== $passwordConfirmation) {
7871
$this->messageManager->addError(__("New Password and Confirm New Password values didn't match."));
79-
$resultRedirect->setPath('*/*/createPassword', ['id' => $customerId, 'token' => $resetPasswordToken]);
72+
$resultRedirect->setPath(
73+
'*/*/createPassword',
74+
['token' => $resetPasswordToken]
75+
);
8076
return $resultRedirect;
8177
}
8278
if (iconv_strlen($password) <= 0) {
8379
$this->messageManager->addError(__('Please enter a new password.'));
84-
$resultRedirect->setPath('*/*/createPassword', ['id' => $customerId, 'token' => $resetPasswordToken]);
80+
$resultRedirect->setPath(
81+
'*/*/createPassword',
82+
['token' => $resetPasswordToken]
83+
);
8584
return $resultRedirect;
8685
}
8786

8887
try {
89-
$customerEmail = $this->customerRepository->getById($customerId)->getEmail();
90-
$this->credentialsValidator->checkPasswordDifferentFromEmail($customerEmail, $password);
91-
$this->accountManagement->resetPassword($customerEmail, $resetPasswordToken, $password);
88+
$this->accountManagement->resetPassword(
89+
'',
90+
$resetPasswordToken,
91+
$password
92+
);
9293
$this->session->unsRpToken();
93-
$this->session->unsRpCustomerId();
9494
$this->messageManager->addSuccess(__('You updated your password.'));
9595
$resultRedirect->setPath('*/*/login');
9696
return $resultRedirect;
@@ -102,7 +102,11 @@ public function execute()
102102
} catch (\Exception $exception) {
103103
$this->messageManager->addError(__('Something went wrong while saving the new password.'));
104104
}
105-
$resultRedirect->setPath('*/*/createPassword', ['id' => $customerId, 'token' => $resetPasswordToken]);
105+
106+
$resultRedirect->setPath(
107+
'*/*/createPassword',
108+
['token' => $resetPasswordToken]
109+
);
106110
return $resultRedirect;
107111
}
108112
}

‎app/code/Magento/Customer/Model/AccountManagement.php

Lines changed: 64 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
use Magento\Customer\Model\Metadata\Validator;
2020
use Magento\Eav\Model\Validator\Attribute\Backend;
2121
use Magento\Framework\Api\ExtensibleDataObjectConverter;
22+
use Magento\Framework\Api\SearchCriteriaBuilder;
2223
use Magento\Framework\App\Area;
2324
use Magento\Framework\App\Config\ScopeConfigInterface;
2425
use Magento\Framework\App\ObjectManager;
@@ -40,6 +41,7 @@
4041
use Magento\Framework\Intl\DateTimeFactory;
4142
use Magento\Framework\Mail\Template\TransportBuilder;
4243
use Magento\Framework\Math\Random;
44+
use Magento\Framework\Phrase;
4345
use Magento\Framework\Reflection\DataObjectProcessor;
4446
use Magento\Framework\Registry;
4547
use Magento\Framework\Stdlib\DateTime;
@@ -325,6 +327,11 @@ class AccountManagement implements AccountManagementInterface
325327
*/
326328
private $accountConfirmation;
327329

330+
/**
331+
* @var SearchCriteriaBuilder
332+
*/
333+
private $searchCriteriaBuilder;
334+
328335
/**
329336
* @param CustomerFactory $customerFactory
330337
* @param ManagerInterface $eventManager
@@ -356,6 +363,7 @@ class AccountManagement implements AccountManagementInterface
356363
* @param SessionManagerInterface|null $sessionManager
357364
* @param SaveHandlerInterface|null $saveHandler
358365
* @param CollectionFactory|null $visitorCollectionFactory
366+
* @param SearchCriteriaBuilder|null $searchCriteriaBuilder
359367
* @SuppressWarnings(PHPMD.ExcessiveParameterList)
360368
*/
361369
public function __construct(
@@ -387,7 +395,8 @@ public function __construct(
387395
AccountConfirmation $accountConfirmation = null,
388396
SessionManagerInterface $sessionManager = null,
389397
SaveHandlerInterface $saveHandler = null,
390-
CollectionFactory $visitorCollectionFactory = null
398+
CollectionFactory $visitorCollectionFactory = null,
399+
SearchCriteriaBuilder $searchCriteriaBuilder = null
391400
) {
392401
$this->customerFactory = $customerFactory;
393402
$this->eventManager = $eventManager;
@@ -423,6 +432,8 @@ public function __construct(
423432
?: ObjectManager::getInstance()->get(SaveHandlerInterface::class);
424433
$this->visitorCollectionFactory = $visitorCollectionFactory
425434
?: ObjectManager::getInstance()->get(CollectionFactory::class);
435+
$this->searchCriteriaBuilder = $searchCriteriaBuilder
436+
?: ObjectManager::getInstance()->get(SearchCriteriaBuilder::class);
426437
}
427438

428439
/**
@@ -596,14 +607,62 @@ public function initiatePasswordReset($email, $template, $websiteId = null)
596607
return false;
597608
}
598609

610+
/**
611+
* Match a customer by their RP token.
612+
*
613+
* @param string $rpToken
614+
* @throws ExpiredException
615+
* @throws NoSuchEntityException
616+
*
617+
* @return CustomerInterface
618+
*/
619+
private function matchCustomerByRpToken(string $rpToken): CustomerInterface
620+
{
621+
622+
$this->searchCriteriaBuilder->addFilter(
623+
'rp_token',
624+
$rpToken
625+
);
626+
$this->searchCriteriaBuilder->setPageSize(1);
627+
$found = $this->customerRepository->getList(
628+
$this->searchCriteriaBuilder->create()
629+
);
630+
631+
if ($found->getTotalCount() > 1) {
632+
//Failed to generated unique RP token
633+
throw new ExpiredException(
634+
new Phrase('Reset password token expired.')
635+
);
636+
}
637+
if ($found->getTotalCount() === 0) {
638+
//Customer with such token not found.
639+
throw NoSuchEntityException::singleField(
640+
'rp_token',
641+
$rpToken
642+
);
643+
}
644+
645+
//Unique customer found.
646+
return $found->getItems()[0];
647+
}
648+
599649
/**
600650
* {@inheritdoc}
601651
*/
602652
public function resetPassword($email, $resetToken, $newPassword)
603653
{
604-
$customer = $this->customerRepository->get($email);
654+
if (!$email) {
655+
$customer = $this->matchCustomerByRpToken($resetToken);
656+
$email = $customer->getEmail();
657+
} else {
658+
$customer = $this->customerRepository->get($email);
659+
}
605660
//Validate Token and new password strength
606661
$this->validateResetPasswordToken($customer->getId(), $resetToken);
662+
$this->credentialsValidator->checkPasswordDifferentFromEmail(
663+
$email,
664+
$newPassword
665+
);
607666
$this->checkPasswordStrength($newPassword);
608667
//Update secure data
609668
$customerSecure = $this->customerRegistry->retrieveSecureData($customer->getId());
@@ -1011,12 +1070,9 @@ public function isCustomerInStore($customerWebsiteId, $storeId)
10111070
private function validateResetPasswordToken($customerId, $resetPasswordLinkToken)
10121071
{
10131072
if (empty($customerId) || $customerId < 0) {
1014-
throw new InputException(
1015-
__(
1016-
'Invalid value of "%value" provided for the %fieldName field.',
1017-
['value' => $customerId, 'fieldName' => 'customerId']
1018-
)
1019-
);
1073+
//Looking for the customer.
1074+
$customerId = $this->matchCustomerByRpToken($resetPasswordLinkToken)
1075+
->getId();
10201076
}
10211077
if (!is_string($resetPasswordLinkToken) || empty($resetPasswordLinkToken)) {
10221078
$params = ['fieldName' => 'resetPasswordLinkToken'];

0 commit comments

Comments
 (0)