8

I am working on a Laravel project. I was not the original developer, so if I make a mistake, forgive me and explain what it was please.

In this project, we have a module to request a new password. when the form is submited, the user is redirected to route('password.request') which is, I believe, somewhere hidden in the framework.

The problem is that when the user gets it's new password, he is automaticaly logged in and can access the pages. But he is not supposed to because he does not have admin rights.

So I tried to logout and redirect the user to the main page, without any luck.

Can someone explain why is laravel (or "me", as they are some parts of the project I have not explored yet) doing that and how to fix this?

reset.blade.php (form to request new password)

form class="form-horizontal" role="form" method="POST" action="{{ route('password.request') }}">
    {{ csrf_field() }}

    <input type="hidden" name="token" value="{{ $token }}">
....

my custom logout route:

Route::get('/customLogout', 'Auth\LoginController@customLogout');

resetPasswordController.php

<?php

namespace App\Http\Controllers\Auth;

use App\Http\Controllers\Controller;
use Illuminate\Foundation\Auth\ResetsPasswords;

class ResetPasswordController extends Controller
{
    /*
    |--------------------------------------------------------------------------
    | Password Reset Controller
    |--------------------------------------------------------------------------
    |
    | This controller is responsible for handling password reset requests
    | and uses a simple trait to include this behavior. You're free to
    | explore this trait and override any methods you wish to tweak.
    |
    */

    use ResetsPasswords;

    /**
     * Where to redirect users after resetting their password.
     *
     * @var string
     */
    protected $redirectTo = '/customLogout';

    /**
     * Create a new controller instance.
     *
     * @return void
     */
    public function __construct()
    {
        $this->middleware('guest');
    }
}

method in LoginController.php

public function customLogout(){
        //Session::flush();       
        return redirect()->route('/');
            }
6
  • As you mentioned "The problem is that when the user gets it's new password, he is automaticaly logged in and can access the pages." . Basically this is the actual flow. if you reset your password . you should automatically logged in to site . So what's your problem ? Oct 2, 2017 at 12:07
  • @Tej, from my understanding, the Op doesn't want it to automatically log in.
    – Option
    Oct 2, 2017 at 12:09
  • Then there is only only one way . you have to flush your session and call your logout function . user will redirect to main page . But i do not recommend this approach. Oct 2, 2017 at 12:13
  • Is your route listed in the result of php artisan route:list?
    – Laerte
    Oct 2, 2017 at 12:27
  • @Laerte The command returns: "constant SERVER_URL already defined" Oct 3, 2017 at 0:29

2 Answers 2

12

Ok, I (finnaly) found a way.

I overrided the function called "resetPassword" and deleted the login piece of code.

This function comes from the framework (can't remember the file, if someone could help on that :S ) I overrided the function in my ResetPasswordController.php

protected function resetPassword($user, $password)
    {
        $user->forceFill([
            'password' => bcrypt($password),
            'remember_token' => Str::random(60),
        ])->save();

        //$this->guard()->login($user);
    }

This make my password changing and redirect automaticaly to the main page.

Edit: Oh, and don't forget to add this in your includes:

use Illuminate\Support\Str;
4
  • ResetPasswordController.php File path: \vendor\laravel\framework\src\Illuminate\Foundation\Auth\RegisterPassqwordController.php Jan 26, 2019 at 16:29
  • 5
    It is very non-technical to make changes in files in vendor directory. Not recommended. @UtkarshVishnoi May 31, 2019 at 7:36
  • What is forceFill? Jan 4, 2021 at 14:29
  • @jayantrawat I do not remember. It was 4 years ago and I have not practiced this since that time. Jan 4, 2021 at 15:18
0

Go to auth/ResetPasswordController

and override this method resetPassword method and make it like this

/**
 * Reset the given user's password.
 *
 * @param  \Illuminate\Contracts\Auth\CanResetPassword  $user
 * @param  string  $password
 * @return void
 */
protected function resetPassword($user, $password)
{
    $this->setUserPassword($user, $password);
    $user->save();
    event(new PasswordReset($user));
}

at the top of controller add this line to avoid any error

use Illuminate\Auth\Events\PasswordReset;
1
  • To avoid error add more of this lines at the top controller: use Illuminate\Support\Facades\Hash; use Illuminate\Support\Str; Oct 27, 2021 at 12:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.