search

stormpath / stormpath-laravel

Build simple, secure web applications with Stormpath and Laravel
Other
29 stars 6 forks source link

Forgot password endpoint shouldn't need to be explicitly enabled #45

Open edjiang opened 8 years ago

edjiang commented 8 years ago

https://docs.stormpath.com/php/laravel/latest/password_reset.html#enable-the-workflow

https://github.com/stormpath/stormpath-framework-spec/blob/master/password-reset.md

If the default account store of the stormapth application has the password reset workflow enabled, and stormpath.web.forgotPassword.enabled is not set to false

This is really weird. I am going to try smoothing this out with @robertjd. I understand the rationale behind it, though (since it should only be enabled because of the directory configuration).

bretterer commented 8 years ago

@edjiang It is set up currently in a way that allows you to leave it as null to have the system determine if it should be enabled or not. In looking at this, I did find that it is changePassword that is not set. The dreaded copy and paste error got me in duplicating code but not updating it.

See https://github.com/stormpath/stormpath-laravel/blob/develop/src/Support/StormpathLaravelServiceProvider.php#L300-L309 for what I am talking about.

I will patch this in the next release.

bretterer commented 8 years ago

I will also make a note to update documentation for this.