', array('absolute' => TRUE)));
- }
- else {
- // Time out, in seconds, until login URL expires.
- $timeout = \Drupal::config('user.settings')->get('password_reset_timeout');
- $current = REQUEST_TIME;
- $account = user_load($uid);
- // Verify that the user exists and is active.
- if ($timestamp <= $current && $account && $account->isActive()) {
- // No time out for first time login.
- if ($account->getLastLoginTime() && $current - $timestamp > $timeout) {
- drupal_set_message(t('You have tried to use a one-time login link that has expired. Please request a new one using the form below.'));
- return new RedirectResponse(url('user/password', array('absolute' => TRUE)));
- }
- elseif ($account->isAuthenticated() && $timestamp >= $account->getLastLoginTime() && $timestamp <= $current && $hashed_pass == user_pass_rehash($account->getPassword(), $timestamp, $account->getLastLoginTime())) {
- // First stage is a confirmation form, then login
- if ($action == 'login') {
- // Set the new user.
- // user_login_finalize() also updates the login timestamp of the
- // user, which invalidates further use of the one-time login link.
- user_login_finalize($account);
- watchdog('user', 'User %name used one-time login link at time %timestamp.', array('%name' => $account->getUsername(), '%timestamp' => $timestamp));
- drupal_set_message(t('You have just used your one-time login link. It is no longer necessary to use this link to log in. Please change your password.'));
- // Let the user's password be changed without the current password check.
- $token = Crypt::randomStringHashed(55);
- $_SESSION['pass_reset_' . $user->id()] = $token;
- return new RedirectResponse(url('user/' . $user->id() . '/edit', array(
- 'query' => array('pass-reset-token' => $token),
- 'absolute' => TRUE,
- )));
- }
- else {
- if (!$account->getLastLoginTime()) {
- // No expiration for first time login.
- $form['message'] = array('#markup' => t('This is a one-time login for %user_name.
Click on this button to log in to the site and change your password.
', array('%user_name' => $account->getUsername())));
- }
- else {
- $form['message'] = array('#markup' => t('This is a one-time login for %user_name and will expire on %expiration_date.
Click on this button to log in to the site and change your password.
', array('%user_name' => $account->getUsername(), '%expiration_date' => format_date($timestamp + $timeout))));
- }
- $form['help'] = array('#markup' => '' . t('This login can be used only once.') . '
');
- $form['actions'] = array('#type' => 'actions');
- $form['actions']['submit'] = array('#type' => 'submit', '#value' => t('Log in'));
- $form['#action'] = url("user/reset/$uid/$timestamp/$hashed_pass/login");
- return $form;
- }
- }
- else {
- drupal_set_message(t('You have tried to use a one-time login link that has either been used or is no longer valid. Please request a new one using the form below.'));
- return new RedirectResponse(url('user/password', array('absolute' => TRUE)));
- }
- }
- else {
- // Deny access, no more clues.
- // Everything will be in the watchdog's URL for the administrator to check.
- throw new AccessDeniedHttpException();
- }
- }
-}
-
-/**
* Implements hook_help().
*/
function user_help($route_name, RouteMatchInterface $route_match) {