Prevent email change on password reset laravel 5.7

Question

How I can prevent email change on password reset page in Laravel?

I have input email:

<div class="col-md-6">
                            <input id="email" readonly type="email" class="form-control{{ $errors->has('email') ? ' is-invalid' : '' }}" name="email" value="{{ $email ?? old('email') }}" required autofocus>

                            @if ($errors->has('email'))
                                <span class="invalid-feedback" role="alert">
                                    <strong>{{ $errors->first('email') }}</strong>
                                </span>
                            @endif
                        </div>

I pasted attribute readonly , but input email is empty. How I can pass email user and prevent change email for it?

In ResetPasswordController I have:

 public function showResetForm(Request $request, $token = null)
{
    $email = //getUserEmail ?
    return view('auth.passwords.reset')->with(
        ['token' => $token, 'email' => $request->email]
    );
}

/**
 * Get the password reset validation rules.
 *
 * @return array
 */
protected function rules()
{
    return [
        'token' => 'required',
        'email' => 'required|email|exists:users,email',
        'password' => 'required|confirmed|min:6',
    ];
}

How I can change $request->email on current user email, who reset password?

Answer 1

If i am getting your question well you want to show email but in readonly only format for reset password page. i am suggesting you some way for it. feel free to use any.

Solution 1 : inside, ResetPasswordController -> showResetForm()

    $password_resets = DB::table('password_resets')->get();
    foreach($password_resets as $password_reset)
    {
        if (Hash::check($token, $password_reset->token)) { // checking hash match with requested token
            // here if hash match with token
            $email = $password_reset->email;
        }
    }

Here, we are looping through password_resets table and checking if reset password token matches with actual hashed token in table. you can easily use $email inside reset.blade.php like so :

<input id="email" type="email" class="form-control{{ $errors->has('email') ? ' is-invalid' : '' }}" name="email" value="{{ isset($email) ? $email : '' }}" required readonly>

Solution 2:

At the time of sending password reset email you can pass email as base64_encode and can access it using base64_decode at the time of reset password.

Hope, this helps you. enjoy coding :)