PasswordReset.module

<?php

class PasswordReset extends WireData implements Module
{
    private $field = [];
    private $errorMessage;
    private $userEmail;

    public static function getModuleInfo() {
        return array(
            'title' => 'Password Reset',
            'summary' => 'Customizable frontend password reset',
            'version' => 6,
            'autoload' => false,
            'singular' => true
        );
    }


    public function init() {
        $this->errorMessage = $this->session->errorMessage;
        $this->session->remove('errorMessage');
    }


    private function setField() {
        if ($this->fieldname == 'name') {
            $this->field['name'] = 'name';
            $this->field['label'] = __('Username'); // Label for 'name' field
        } else {
            $field = wire('fields')->get($this->fieldname);
            $localizedLabel = "label" . $this->user->language->id;
            $localizedLabel = $field->{$localizedLabel};
            $this->field['name'] = $field->name;
            $this->field['label'] = (!empty($localizedLabel)) ? $localizedLabel : $field->label;
        }
    }


    public function getScripts() {
        return "{$this->config->urls->siteModules}{$this->className}/js/password-reset.js";
    }


    private function getRequestForm() {
        // TODO : Probably implement urlSlashes check next line
        $form = "<form class='password-reset' action='request-key/' method='post'>" . PHP_EOL;
        if (!empty($this->errorMessage)) $form .= "<div class='error'>{$this->errorMessage}</div>";
        $form .= "<label for='{$this->field['name']}-input'>{$this->field['label']}</label>" . PHP_EOL;
        $form .= "<input id='{$this->field['name']}-input' type='text' name='{$this->field['name']}' value=''>" . PHP_EOL;
        if(class_exists('LanguageSupport',false)) {
            // TODO : Fallback to default ?
            $langId = $this->user->language->id;
            $instructions = $this->{'instructions' . $langId};
            if (!empty($instructions)) $form .= "<div class='instructions'>{$instructions}</div>";
        } else {
            if (!empty($this->instructions)) $form .= "<div class='instructions'>{$this->instructions}</div>";
        }
        $form .= "<input type='submit' value='" . __("Reset my password") . "'>"; // Button on first step form
        $form .= "</form>";

        return $form;
    }


    private function sendRequestEmail() {
        $email = wireMail();
        $email->from($this->emailAddress, $this->emailName);
        $email->to($this->userEmail);
        $email->subject(__('Password reset')); // Email subject

        $body1 = __('To reset your password, please click the following link:'); // Email body first line
        $body2 = __('If you did not request a password change, you can safely ignore this email.'); // Email body last line (after link)
        $email->bodyHTML("<p>{$body1}</p><p><a href='{$this->page->httpUrl}key/{$this->key}/'>{$this->page->httpUrl}key/{$this->key}/</a></p><p>{$body2}</p>");
        $email->send();
    }


    private function generateKey() {
        // generate key
        $this->key = hash('sha256', openssl_random_pseudo_bytes(64));

        // set expiration time
        $date = new DateTime('now');
        $date->add(new DateInterval('PT24H'));
        $expiration = $date->getTimestamp();

        // get user or redirect back to form is user doesn't exist
        $credentials = $this->sanitizer->text($this->input->post($this->field['name']));
        if (!empty($credentials)) {
            $user = wire('users')->get("{$this->field['name']}={$this->input->post($this->field['name'])}");
            if (is_a($user, 'NullPage')) {
                $this->session->errorMessage = __('No user found matching those credentials.'); // Error
                $this->session->redirect($this->page->url);
            }
        } else {
            $this->session->errorMessage = __('The form must be filled.'); // Error
            $this->session->redirect($this->page->url);
        }

        $this->userEmail = $user->email;

        $keyPage = new Page();
        $keyPage->template = 'password-reset-request';
        $keyPage->parent_id = $this->page->id;
        $keyPage->title = $this->key;
        $keyPage->name = $this->key;
        $keyPage->passwordResetExpiration = $expiration;
        $keyPage->passwordResetUser = $user;
        $keyPage->save();
    }


    private function requestKeyIsValid() {
        if ($this->page->children('name='.$this->getKey())->count() !== 1) {
            $this->errorMessage = "<p class='error invalid'>".__('Invalid password reset key.')."</p>"; // Error
        } else if ($this->page->get('name='.$this->getKey())->passwordResetExpiration < time()) {
            $this->errorMessage = "<p class='error expired'>".__('Your password reset key expired.')."</p>"; // Error
            $this->deleteRequestKey();
        } else {
            return true;
        }
    }


    private function deleteRequestKey() {
        $key = $this->page->get('name='.$this->getKey())->delete();
    }


    private function getRequestKeyMessage() {
        $message = "<div class='password-reset request'><p>".__('An email containing a link allowing you to reset your password was sent to you.')."</p>"; // Message step 2
        $message .= "<p>".__('This reset link will expire in 24 hours.')."</p></div>"; // Message step 2, second line
        return $message;
    }


    private function getKey() {
        if ($this->input->post('request-key') !== null) {
            $this->key = $this->input->post('request-key');
        } else {
            $this->key = $this->input->urlSegment2;
        }
        return $this->key;
    }


    private function getKeyPage() {
        return $this->page->get('name='.$this->getKey());
    }


    private function getResetForm() {
        if ($this->requestKeyIsValid() === true) {
            $form = "<form class='password-reset reset-form' action='{$this->page->url}reset/' method='post'>" . PHP_EOL;
            if (!empty($this->errorMessage)) $form .= "<div class='error'>{$this->errorMessage}</div>";
            $form .= "<label for='new-password'>".__('Please choose a new password')."</label>" . PHP_EOL; // Label on reset form, after email is received
            $form .= "<input id='new-password' type='password' name='new-password' value=''>" . PHP_EOL;
            $form .= "<label class='display-password'><input id='display-password' type='checkbox' name='display-password' value=''>".__('Show password')."</label>" . PHP_EOL; // JS password reveal
            if(class_exists('LanguageSupport',false)) {
                // TODO : Fallback to default ?
                $langId = $this->user->language->id;
                $instructions = $this->{'passwordInstructions' . $langId};
                if (!empty($instructions)) $form .= "<div class='instructions'>{$instructions}</div>";
            } else {
                if (!empty($this->passwordInstructions)) $form .= "<div class='instructions'>{$this->ipasswordInstructions}</div>";
            }
            $form .= "<input id='request-key' type='hidden' name='request-key' value='".$this->getKey()."'>" . PHP_EOL;
            $form .= "<input type='submit' value='" . __("Reset my password") . "'>"; // Submit new password button
            $form .= "</form>";

            return $form;
        } else {
            // get returned error message
            return $this->errorMessage;
        }
    }


    private function resetPassword() {
        if ($this->requestKeyIsValid() === true) {
            if (mb_strlen($this->input->post('new-password')) < $this->passwordLength) {
                $this->session->errorMessage = sprintf(__("Your password must contain at least %d characters."),$this->passwordLength); // Error
                $this->session->redirect($this->page->url . "/key/" . $this->getKey() . "/");
            }
            $user = $this->getKeyPage()->passwordResetUser;
            $user->of(false);
            $user->pass = $this->sanitizer->text($this->input->post('new-password'));
            $user->save();

            $this->deleteRequestKey();

            return "<p>".__("Your password was successfully reset.")."</p>"; // Last screen success message
        } else {
            return $this->errorMessage;
        }
    }


    private function deleteAllExpiredKeys() {
        $time = new DateTime('now');
        $time = $time->getTimestamp();
        $expiredKeys = $this->pages->find("parent={$this->page->id}, passwordResetExpiration<{$time}");
        foreach ($expiredKeys as $key) {
            $key->delete();
        }
    }


    public function controller() {
        $this->setField();
        $segment1 = ($this->input->urlSegment1);
        $segment2 = ($this->input->urlSegment2);

        $this->deleteAllExpiredKeys();

        if (empty($segment1)) {
            $this->session->requestKeySent = false;
            return $this->getRequestForm();
        } else if ($segment1 === 'request-key') {
            // generate key, send message and prevent requesting another key by accident or on refresh
            if ($this->session->requestKeySent !== true) {
                $this->generateKey();
                $this->sendRequestEmail();
                $this->session->requestKeySent = true;
                return $this->getRequestKeyMessage();
            } else {
                return $this->getRequestKeyMessage();
            }
        } else if ($segment1 === 'key' and empty($segment2)) {
            wire('session')->redirect($this->page->url);
        } else if ($segment1 === 'key' and !empty($segment2)) {
            return $this->getResetForm();
        } else if ($segment1 === 'reset') {
            return $this->resetPassword();
        }
    }


    public function ___install() {
        // password reset request template (the child storing requests)
        $expirationField = new Field();
        $expirationField->type = $this->modules->get('FieldtypeInteger');
        $expirationField->name = 'passwordResetExpiration';
        $expirationField->save();

        $userField = new Field();
        $userField->type = $this->modules->get('FieldtypePage');
        $userTemplateId = $this->templates->get('user')->id;
        $userField->data('derefAsPage', 1);
        $userField->data('template_id', $userTemplateId);
        $userField->name = 'passwordResetUser';
        $userField->save();

        $requestFieldgroup = new Fieldgroup();
        $requestFieldgroup->name = 'password-reset-request';
        $requestFieldgroup->add($this->fields->get('title'));
        $requestFieldgroup->add($expirationField);
        $requestFieldgroup->add($userField);
        $requestFieldgroup->save();

        $requestTemplate = new Template();
        $requestTemplate->name = 'password-reset-request';
        $requestTemplate->fieldgroup = $requestFieldgroup;
        $requestTemplate->noChildren = true;
        $requestTemplate->save();


        // password reset template (the parent under which individual requests are stored)
        $fg = new Fieldgroup();
        $fg->name = 'password-reset';
        $fg->add($this->fields->get('title'));
        $fg->save();

        $passwordResetTemplate = new Template();
        $passwordResetTemplate->name = 'password-reset';
        $passwordResetTemplate->urlSegments(true);
        $passwordResetTemplate->fieldgroup = $fg;
        $passwordResetTemplate->childTemplates = [$requestFieldgroup->id];
        $passwordResetTemplate->childrenTemplatesID;
        $passwordResetTemplate->save();

        $requestTemplate->parentTemplates = [$passwordResetTemplate->id];
        $requestTemplate->save();
    }
}