Same name in other branches

1. 8.9.x core/modules/user/src/Controller/UserController.php \Drupal\user\Controller\UserController::resetPassLogin()
2. 10 core/modules/user/src/Controller/UserController.php \Drupal\user\Controller\UserController::resetPassLogin()
3. 11.x core/modules/user/src/Controller/UserController.php \Drupal\user\Controller\UserController::resetPassLogin()

Validates user, hash, and timestamp; logs the user in if correct.

Parameters

int $uid: User ID of the user requesting reset.

int $timestamp: The current timestamp.

string $hash: Login link hash.

\Symfony\Component\HttpFoundation\Request $request: The request.

Return value

\Symfony\Component\HttpFoundation\RedirectResponse Returns a redirect to the user edit form if the information is correct. If the information is incorrect redirects to 'user.pass' route with a message for the user.

Throws

\Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException If $uid is for a blocked user or invalid user ID.

1 string reference to 'UserController::resetPassLogin'

user.routing.yml in core/modules/user/user.routing.yml

core/modules/user/user.routing.yml

File

core/modules/user/src/Controller/UserController.php, line 231

Class

UserController

Controller routines for user routes.

Namespace

Drupal\user\Controller

Code

public function resetPassLogin($uid, $timestamp, $hash, Request $request) {
    
    /** @var \Drupal\user\UserInterface $user */
    $user = $this->userStorage
        ->load($uid);
    if ($redirect = $this->determineErrorRedirect($user, $timestamp, $hash)) {
        return $redirect;
    }
    $flood_config = $this->config('user.flood');
    if ($flood_config->get('uid_only')) {
        $identifier = $user->id();
    }
    else {
        $identifier = $user->id() . '-' . $request->getClientIP();
    }
    $this->flood
        ->clear('user.failed_login_user', $identifier);
    $this->flood
        ->clear('user.http_login', $identifier);
    user_login_finalize($user);
    $this->logger
        ->notice('User %name used one-time login link at time %timestamp.', [
        '%name' => $user->getDisplayName(),
        '%timestamp' => $timestamp,
    ]);
    $this->messenger()
        ->addStatus($this->t('You have just used your one-time login link. It is no longer necessary to use this link to log in. Please set your password.'));
    // Let the user's password be changed without the current password
    // check.
    $token = Crypt::randomBytesBase64(55);
    $request->getSession()
        ->set('pass_reset_' . $user->id(), $token);
    // Clear any flood events for this user.
    $this->flood
        ->clear('user.password_request_user', $uid);
    return $this->redirect('entity.user.edit_form', [
        'user' => $user->id(),
    ], [
        'query' => [
            'pass-reset-token' => $token,
        ],
        'absolute' => TRUE,
    ]);
}

---