modules/acm/src/Controller/CommerceUserController.php
public function resetPassLogin(Request $request, $email, $timestamp, $hash) {
    $user = NULL;
    $email = base64_decode($email);

    try {
      $user = $this->apiWrapper->getCustomer($email);
    }
    catch (\Exception $e) {
    }

    // Verify that the user exists and is active.
    if (!$user) {
      // Blocked or invalid user, so deny access. The parameters will be in the
      // watchdog's URL for the administrator to check.
      throw new AccessDeniedHttpException();
    }

    // Wrap user in CommerceUserSession.
    $account = new CommerceUserSession($user);

    // The current user is not logged in, so check the parameters.
    $current = REQUEST_TIME;
    // Time out, in seconds, until login URL expires.
    $timeout = $this->config('user.settings')->get('password_reset_timeout');

    if ($current - $timestamp > $timeout) {
      drupal_set_message($this->t('you have tried to use a one-time password reset link that has expired. Please request a new one using the form below.'), 'error');
      return $this->redirect('acm.external_user_password');
    }
    elseif (($timestamp <= $current) && Crypt::hashEquals($hash, acm_commerce_user_pass_rehash($account, $timestamp))) {
      $password_values = $request->get('new_password');
      $pass1 = trim($password_values['pass1']);
      $pass2 = trim($password_values['pass2']);
      if (strlen($pass1) > 0 || strlen($pass2) > 0) {
        if (strcmp($pass1, $pass2)) {
          // Passwords don't match, return back to the reset password page so
          // they can correct.
          drupal_set_message($this->t('The passwords you entered do not match.'), 'error');
          return $this->redirect(
            'acm.external_user_password_reset', [
              'email' => base64_encode($email),
              'timestamp' => $timestamp,
              'hash' => $hash,
            ]
          );
        }
      }

      $updated_user = FALSE;
      try {
        // Update customer's password.
        $updated_user = $this->apiWrapper->updateCustomer($user, ['password' => $pass1]);
        // Generate and store the access token and log the user in.
        if ($token = $this->userAuth->authenticate($email, $pass1)) {
          $this->commerceUserManager->setAccessToken($token);
          // This will retrieve and store the account with the new access token.
          $this->commerceUserManager->getAccount();
        }
      }
      catch (\Exception $e) {
      }

      if ($updated_user) {
        drupal_set_message($this->t('Your password has been updated.'));
        return $this->redirect('acm_customer.view_page');
      }
      else {
        drupal_set_message($this->t('There was an issue updating your password.'), 'error');
        return $this->redirect('acm.external_user_password');
      }
    }

    drupal_set_message($this->t('You have tried to use a one-time password reset link that has either been used or is no longer valid. Please request a new one using the form below.'), 'error');
    return $this->redirect('acm.external_user_password');
  }
public function resetPassLogin(Request $request, $email, $timestamp, $hash) {
    $user = NULL;
    $email = base64_decode($email);

    try {
      $user = $this->apiWrapper->getCustomer($email);
    }
    catch (\Exception $e) {
    }

    // Verify that the user exists and is active.
    if (!$user) {
      // Blocked or invalid user, so deny access. The parameters will be in the
      // watchdog's URL for the administrator to check.
      throw new AccessDeniedHttpException();
    }

    // Wrap user in CommerceUserSession.
    $account = new CommerceUserSession($user);

    // The current user is not logged in, so check the parameters.
    $current = REQUEST_TIME;
    // Time out, in seconds, until login URL expires.
    $timeout = $this->config('user.settings')->get('password_reset_timeout');

    if ($current - $timestamp > $timeout) {
      drupal_set_message($this->t('you have tried to use a one-time password reset link that has expired. Please request a new one using the form below.'), 'error');
      return $this->redirect('acm.external_user_password');
    }
    elseif (($timestamp <= $current) && Crypt::hashEquals($hash, acm_commerce_user_pass_rehash($account, $timestamp))) {
      $password_values = $request->get('new_password');
      $pass1 = trim($password_values['pass1']);
      $pass2 = trim($password_values['pass2']);
      if (strlen($pass1) > 0 || strlen($pass2) > 0) {
        if (strcmp($pass1, $pass2)) {
          // Passwords don't match, return back to the reset password page so
          // they can correct.
          drupal_set_message($this->t('The passwords you entered do not match.'), 'error');
          return $this->redirect(
            'acm.external_user_password_reset', [
              'email' => base64_encode($email),
              'timestamp' => $timestamp,
              'hash' => $hash,
            ]
          );
        }
      }

      $updated_user = FALSE;
      try {
        // Update customer's password.
        $updated_user = $this->apiWrapper->updateCustomer($user, ['password' => $pass1]);
        // Generate and store the access token and log the user in.
        if ($token = $this->userAuth->authenticate($email, $pass1)) {
          $this->commerceUserManager->setAccessToken($token);
          // This will retrieve and store the account with the new access token.
          $this->commerceUserManager->getAccount();
        }
      }
      catch (\Exception $e) {
      }

      if ($updated_user) {
        drupal_set_message($this->t('Your password has been updated.'));
        return $this->redirect('acm_customer.view_page');
      }
      else {
        drupal_set_message($this->t('There was an issue updating your password.'), 'error');
        return $this->redirect('acm.external_user_password');
      }
    }

    drupal_set_message($this->t('You have tried to use a one-time password reset link that has either been used or is no longer valid. Please request a new one using the form below.'), 'error');
    return $this->redirect('acm.external_user_password');
  }
public function resetPassLogin ( Request $ request , $ email , $ timestamp , $ hash ) { $ user = NULL ; $ email = base64_decode ( $ email ) ; try { $ user = $ this -> apiWrapper -> getCustomer ( $ email ) ; } catch ( \ Exception $ e ) { } // Verify that the user exists and is active. if ( ! $ user ) { // Blocked or invalid user, so deny access. The parameters will be in the // watchdog's URL for the administrator to check. throw new AccessDeniedHttpException ( ) ; } // Wrap user in CommerceUserSession. $ account = new CommerceUserSession ( $ user ) ; // The current user is not logged in, so check the parameters. $ current = REQUEST_TIME ; // Time out, in seconds, until login URL expires. $ timeout = $ this -> config ( 'user.settings' ) -> get ( 'password_reset_timeout' ) ; if ( $ current - $ timestamp > $ timeout ) { drupal_set_message ( $ this -> t ( 'you have tried to use a one-time password reset link that has expired. Please request a new one using the form below.' ) , 'error' ) ; return $ this -> redirect ( 'acm.external_user_password' ) ; } elseif ( ( $ timestamp <= $ current ) && Crypt :: hashEquals ( $ hash , acm_commerce_user_pass_rehash ( $ account , $ timestamp ) ) ) { $ password_values = $ request -> get ( 'new_password' ) ; $ pass1 = trim ( $ password_values [ 'pass1' ] ) ; $ pass2 = trim ( $ password_values [ 'pass2' ] ) ; if ( strlen ( $ pass1 ) > 0 || strlen ( $ pass2 ) > 0 ) { if ( strcmp ( $ pass1 , $ pass2 ) ) { // Passwords don't match, return back to the reset password page so // they can correct. drupal_set_message ( $ this -> t ( 'The passwords you entered do not match.' ) , 'error' ) ; return $ this -> redirect ( 'acm.external_user_password_reset' , [ 'email' => base64_encode ( $ email ) , 'timestamp' => $ timestamp , 'hash' => $ hash , ] ) ; } } $ updated_user = FALSE ; try { // Update customer's password. $ updated_user = $ this -> apiWrapper -> updateCustomer ( $ user , [ 'password' => $ pass1 ] ) ; // Generate and store the access token and log the user in. if ( $ token = $ this -> userAuth -> authenticate ( $ email , $ pass1 ) ) { $ this -> commerceUserManager -> setAccessToken ( $ token ) ; // This will retrieve and store the account with the new access token. $ this -> commerceUserManager -> getAccount ( ) ; } } catch ( \ Exception $ e ) { } if ( $ updated_user ) { drupal_set_message ( $ this -> t ( 'Your password has been updated.' ) ) ; return $ this -> redirect ( 'acm_customer.view_page' ) ; } else { drupal_set_message ( $ this -> t ( 'There was an issue updating your password.' ) , 'error' ) ; return $ this -> redirect ( 'acm.external_user_password' ) ; } } drupal_set_message ( $ this -> t ( 'You have tried to use a one-time password reset link that has either been used or is no longer valid. Please request a new one using the form below.' ) , 'error' ) ; return $ this -> redirect ( 'acm.external_user_password' ) ; }
Reset password and log in.

Validates user, hash, and timestamp; logs the user in and resets password
if correct.

@param \Symfony\Component\HttpFoundation\Request $request
The request.
@param int $email
The base64 encoded email address of the user requesting a password reset.
@param int $timestamp
The current timestamp.
@param string $hash
Login link hash.

@return \Symfony\Component\HttpFoundation\RedirectResponse
Returns a redirect to the user edit form if the information is correct.
If the information is incorrect redirects to 'user.pass' route with a
message for the user.

@throws \Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException
If $uid is for a blocked user or invalid user ID.
Reset password and log in .