蛋糕 PHP 密码重置

Question

currently working on a password reset script for a CakePHP application that I have been put in charge of.

So far, I have a forgot script that I created a random string, adding this to the relevant user and emailing the user with a link to reset. (the domain name is in fact the live one)

Click on the link below to Reset Your Password


Click here to Reset Your Password
or Visit this Link

domainnamehere/users/reset/e9bb0ab37ff9175a856f0aff3e18db801451306e5a50bfc618c43280b62628e4bdb8131b638e042b47d42ca1516de11f1b025d646406bfd31054db167d5ef430#62442a331b1f9a3e37cbb9a33c1d619b8a8e0a18

This email was sent using the CakePHP Framework

Upon clicking the reset and loading the reset form, it seems to be skipping right to my last else statement with no token value?

function reset($token=null){
    //$this->layout="Login";
    $this->User->recursive=-1;
    if(!empty($token)){
        $u=$this->User->findBytokenhash($token);
        if($u){
            $this->User->id=$u['User']['id'];
            if(!empty($this->data)){
                $this->User->data=$this->data;
                $this->User->data['User']['username']=$u['User']['username'];
                $new_hash=sha1($u['User']['username'].rand(0,100));//created token
                $this->User->data['User']['tokenhash']=$new_hash;
                if($this->User->validates(array('fieldList'=>array('password','password_retype')))){
                    if($this->User->save($this->User->data))
                    {
                        $this->Session->setFlash('Password Has been Updated');
                        $this->redirect(array('controller'=>'users','action'=>'login'));
                    }
                    else
                    {
                        $this->Session->setFlash('Error updating values');
                    }

                }
                else{

                    $this->set('errors',$this->User->invalidFields());
                }
            }
        }
        else
        {
            $this->Session->setFlash('Token Corrupted,,Please Retry.the reset link work only for once.');
        }
    }
    else{
        // $this->redirect('/');
      $this->Session->setFlash($token);
    }
}

reset.ctp

<div class="users form">
   <?php echo $this->Form->create('User', array('action' => 'reset')); ?>
   <fieldset>
      <legend><?php echo __('Change your Password'); ?></legend>
      <?php
      //debug($users);
      echo $this->Form->input('password', array('label' => 'Change password'));
      echo $this->Form->input('password_retype', array('label' => 'Confirm password', 'type' => 'password'));
      ?>
   </fieldset>
   <?php echo $this->Form->end(__('Submit')); ?>
</div>

any help on this situation would be much appreciated as I am stuck, thanks!

Answer 1

Well,... you are not sending the token back when you submit...

You do

<?php echo $this->Form->create('User', array('action' => 'reset')); ?>

and that submits the form to users/reset , not users/reset/token . So, either pass the token along with the action submit like this

<?php echo $this->Form->create('User', array('action' => 'reset', $token)); ?>

or submit it along with the form as hidden input

  <?php
  //debug($users);
  echo $this->Form->input('password', array('label' => 'Change password'));
  echo $this->Form->input('password_retype', array('label' => 'Confirm password', 'type' => 'password'));

  //here
  echo $this->Form->input('token', array('type'=>'hidden', 'value'=>$token)
  ?>

and get it in the controller like

if (!empty($token) && !empty($this->request->data['User']['token'])) {

In the future, don't expect forms to submit all the values you passed by url, it's not how things work :(

Security tip

If I were evil, or if Voldemort knew internet, he could try to do call your reset url with random tokens to change passwords to voldi-rocks and then try and access the site. I recommend having a valid time for the reset token, if the reset link isn't used within one hour (for example), invalidate it.

Tip of the day

You can put public $recursive = -1; on your User model to avoid putting it on every action in the controller.

Answer 2

我们发现您必须在 reset.ctp 中登顶注册表中显示的其余必填字段，当然是隐藏的，并且一切正常，包括更新密码字段。

Answer 3

function admin_forgotpwd() {

        if (count($this->Session->read("Auth.User"))) {
            return $this->redirect('/');
        }

        $this->set('title_for_layout', 'Forgot Password');

        $this->layout = 'admin_login';
        $this->User->recursive = -1;
        if (!empty($this->data)) {
            if (empty($this->data['User']['email'])) {
                $this->Session->setFlash(__('Please enter your email.'), 'default', array('class' => 'alert alert-success'));
            } else {
                $email = $this->data['User']['email'];
                $fu = $this->User->find('first', array('conditions' => array('User.email' => $email)));
                if ($fu) {
                    //debug($fu);
                    if ($fu['User']['user_status'] == 'active') {
                        $key = Security::hash(String::uuid(), 'sha512', true);
                        $hash = sha1($fu['User']['username'] . rand(0, 100));
                        $url = Router::url(array('controller' => 'users', 'action' => 'reset'), true) . '/' . $key . '#' . $hash;
                        $ms = $url;
                        $ms = wordwrap($ms, 1000);
                        debug($url);
                        $fu['User']['tokenhash'] = $key;
                        $this->User->id = $fu['User']['id'];
                        if ($this->User->saveField('tokenhash', $fu['User']['tokenhash'])) {




                            $this->Session->setFlash(__('Check your email to reset password.', true), 'default', array('class' => 'alert alert-success'));
                            $this->redirect(array('controller' => 'users', 'action' => 'login'));
                            //============EndEmail=============//
                        } else {
                            $this->Session->setFlash(__("Error while generating reset link."), 'default', array('class' => 'alert alert-danger'));
                        }
                    } else {
                        $this->Session->setFlash(__('This account is not active yet.'), 'default', array('class' => 'alert alert-danger'));
                    }
                } else {
                    $this->Session->setFlash(__('Email does not exist'), 'default', array('class' => 'alert alert-danger'));
                }
            }
        }
    }