Add "this wasn't me" functionality to password reset process #22705
+641
−133
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
mneudert
added
c: Security
caddoo
previously approved these changes
Oct 23, 2024
sgiehl
requested changes
Oct 24, 2024
| * | ||
| * @param string $cancelResetPasswordContent The content to render. | ||
| */ | ||
| Piwik::postEvent('Template.loginCancelResetPasswordContent', [&$cancelResetPasswordContent]); |
There was a problem hiding this comment.
The event could also be posted directly in the template within a {{ set }} or similar. Might be a bit less complex, as you can directly see in the template where the data is coming from. On the other side is the comment here above useful and we couldn't add it similarly in the template. So guess I would keep it that way.
Co-authored-by: Stefan Giehl <stefan@matomo.org>
sgiehl
reviewed
Oct 24, 2024
Co-authored-by: Stefan Giehl <stefan@matomo.org>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description:
Extends the password reset process with a "this wasn't me" functionality.
A new link was added to the (reworded) password reset email, allowing a user to invalidate the reset token without changing the user's password.
To support replacing the "reset password process cancelled" view, the event
Template.loginCancelResetPasswordContentcan be listened to. Writing any content to this event's variable will display that instead of the default content.To prepare future auditing capabilities, the reset process has received the events for the three potential steps:
Login.resetPassword.initiatedLogin.resetPassword.cancelledLogin.resetPassword.confirmedfixes #14543
Refs DEV-14582
Review