Same name and namespace in other branches

1. 9 core/modules/user/src/Controller/UserController.php \Drupal\user\Controller\UserController::resetPass()
2. 8.9.x core/modules/user/src/Controller/UserController.php \Drupal\user\Controller\UserController::resetPass()
3. 11.x core/modules/user/src/Controller/UserController.php \Drupal\user\Controller\UserController::resetPass()

Redirects to the user password reset form.

In order to never disclose a reset link via a referrer header this controller must always return a redirect response.

Parameters

\Symfony\Component\HttpFoundation\Request $request: The request.

int $uid: User ID of the user requesting reset.

int $timestamp: The current timestamp.

string $hash: Login link hash.

Return value

\Symfony\Component\HttpFoundation\RedirectResponse The redirect response.

1 string reference to 'UserController::resetPass'

user.routing.yml in core/modules/user/user.routing.yml

core/modules/user/user.routing.yml

File

core/modules/user/src/Controller/UserController.php, line 129

Class

UserController

Controller routines for user routes.

Namespace

Drupal\user\Controller

Code

public function resetPass(Request $request, $uid, $timestamp, $hash) {
    $account = $this->currentUser();
    // When processing the one-time login link, we have to make sure that a user
    // isn't already logged in.
    if ($account->isAuthenticated()) {
        // The current user is already logged in.
        if ($account->id() == $uid) {
            user_logout();
            // We need to begin the redirect process again because logging out will
            // destroy the session.
            return $this->redirect('user.reset', [
                'uid' => $uid,
                'timestamp' => $timestamp,
                'hash' => $hash,
            ]);
        }
        else {
            
            /** @var \Drupal\user\UserInterface $reset_link_user */
            $reset_link_user = $this->userStorage
                ->load($uid);
            if ($reset_link_user && $this->validatePathParameters($reset_link_user, $timestamp, $hash)) {
                $this->messenger()
                    ->addWarning($this->t('Another user (%other_user) is already logged into the site on this computer, but you tried to use a one-time link for user %resetting_user. <a href=":logout">Log out</a> and try using the link again.', [
                    '%other_user' => $account->getAccountName(),
                    '%resetting_user' => $reset_link_user->getAccountName(),
                    ':logout' => Url::fromRoute('user.logout')->toString(),
                ]));
            }
            else {
                // Invalid one-time link specifies an unknown user.
                $this->messenger()
                    ->addError($this->t('The one-time login link you clicked is invalid.'));
            }
            return $this->redirect('<front>');
        }
    }
    
    /** @var \Drupal\user\UserInterface $reset_link_user */
    $reset_link_user = $this->userStorage
        ->load($uid);
    if ($redirect = $this->determineErrorRedirect($reset_link_user, $timestamp, $hash)) {
        return $redirect;
    }
    $session = $request->getSession();
    $session->set('pass_reset_hash', $hash);
    $session->set('pass_reset_timeout', $timestamp);
    return $this->redirect('user.reset.form', [
        'uid' => $uid,
    ]);
}

---