sonata-project / SonataUserBundle

Symfony SonataUserBundle
https://docs.sonata-project.org/projects/SonataUserBundle
MIT License
342 stars 487 forks source link

Admin password reset logic is wrong #888

Closed gremo closed 4 years ago

gremo commented 7 years ago

Environment

Sonata packages

$ composer show sonata-project/*
sonata-project/admin-bundle              3.20.1 The missing Symfony Admin Generator
sonata-project/block-bundle              3.3.2  Symfony SonataBlockBundle
sonata-project/cache                     1.0.7  Cache library
sonata-project/cache-bundle              2.3.1  This bundle provides caching services
sonata-project/classification-bundle     3.3.1  Symfony SonataClassificationBundle
sonata-project/core-bundle               3.4.0  Symfony SonataCoreBundle
sonata-project/datagrid-bundle           2.2.1  Symfony SonataDatagridBundle
sonata-project/doctrine-extensions       1.0.2  Doctrine2 behavioral extensions
sonata-project/doctrine-orm-admin-bundle 3.1.6  Symfony Sonata / Integrate Doctrine ORM into the ...
sonata-project/easy-extends-bundle       2.2.0  Symfony SonataEasyExtendsBundle
sonata-project/exporter                  1.7.1  Lightweight Exporter library
sonata-project/formatter-bundle          3.2.2  Symfony SonataFormatterBundle
sonata-project/google-authenticator      1.0.2  Library to integrate Google Authenticator into a ...
sonata-project/intl-bundle               2.3.1  Symfony SonataIntlBundle
sonata-project/media-bundle              3.5.1  Symfony SonataMediaBundle
sonata-project/notification-bundle       3.1.0  Symfony SonataNotificationBundle
sonata-project/page-bundle               3.5.1  This bundle provides a Site and Page management t...
sonata-project/seo-bundle                2.2.0  Symfony SonataSeoBundle
sonata-project/user-bundle               3.2.4  Symfony SonataUserBundle

Symfony packages

$ composer show symfony/*
symfony/assetic-bundle     v2.8.2  Integrates Assetic into Symfony2
symfony/monolog-bundle     v3.1.0  Symfony MonologBundle
symfony/phpunit-bridge     v2.8.24 Symfony PHPUnit Bridge
symfony/polyfill-apcu      v1.4.0  Symfony polyfill backporting apcu_* functions to lower PHP ver...
symfony/polyfill-intl-icu  v1.4.0  Symfony polyfill for intl's ICU-related data and classes
symfony/polyfill-mbstring  v1.4.0  Symfony polyfill for the Mbstring extension
symfony/polyfill-php54     v1.4.0  Symfony polyfill backporting some PHP 5.4+ features to lower P...
symfony/polyfill-php55     v1.4.0  Symfony polyfill backporting some PHP 5.5+ features to lower P...
symfony/polyfill-php56     v1.4.0  Symfony polyfill backporting some PHP 5.6+ features to lower P...
symfony/polyfill-php70     v1.4.0  Symfony polyfill backporting some PHP 7.0+ features to lower P...
symfony/polyfill-util      v1.4.0  Symfony utilities for portability of PHP codes
symfony/security-acl       v2.8.0  Symfony Security Component - ACL (Access Control List)
symfony/swiftmailer-bundle v2.6.2  Symfony SwiftmailerBundle
symfony/symfony            v2.8.24 The Symfony PHP framework

PHP version

$ php -v
PHP 5.5.38 (cli) (built: Jul 20 2016 11:16:05)
Copyright (c) 1997-2015 The PHP Group
Zend Engine v2.5.0, Copyright (c) 1998-2015 Zend Technologies
    with Zend OPcache v7.0.6-dev, Copyright (c) 1999-2015, by Zend Technologies

Subject

The admin password reset logic is wrong. If you try to reset your password AND you didn't imported FOSUser fronted routes (I don't need register/login/reset login in the frontend), you get an error.

Even if you import routes, you receive a wrong reset url in the resetting email, containing an url to the password reset of front, not of the admin itself (sonata_user_admin_resetting_reset).

Steps to reproduce

  1. Logout from the admin and try to login again
  2. Click "Forgot password"
  3. Enter a valid email address
  4. Click "Password reset"

Expected results

A reset email is sent to the email address, containing a link generated using the route sonata_user_admin_resetting_reset.

Actual results

An exception is thrown:

None of the chained routers were able to generate route: Route 'fos_user_resetting_reset' not found

If you add FOSUser routes to your routing file, the generated password reset url points to the frontend, not to the admin itself.

stale[bot] commented 4 years ago

Is this still relevant? If so, what is blocking it? Is there anything you can do to help move it forward?

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs.