From c0bf870d1e5e44fd9f6e0b7c90f46a068324b7dc Mon Sep 17 00:00:00 2001 From: Simon Hohl Date: Tue, 14 Jan 2025 09:52:01 +0100 Subject: [PATCH] Simplify password reset Instead of requiring username, email, first- and lastname, users only need to provide their email address. --- .../controller/UserManagementController.java | 34 ++++-------- frontend/app/users/pwd-reset.html | 53 +++++++------------ frontend/app/users/pwd-reset.resource.js | 6 +-- 3 files changed, 33 insertions(+), 60 deletions(-) diff --git a/backend/src/main/java/de/uni_koeln/arachne/controller/UserManagementController.java b/backend/src/main/java/de/uni_koeln/arachne/controller/UserManagementController.java index 76e3d069b..c6a328b15 100644 --- a/backend/src/main/java/de/uni_koeln/arachne/controller/UserManagementController.java +++ b/backend/src/main/java/de/uni_koeln/arachne/controller/UserManagementController.java @@ -427,29 +427,17 @@ public Map reset(@RequestBody Map userCredentials, if (userRightsService.isSignedInUser()) return result; - final String userName = getFormData(userCredentials, "username", true, "ui.passwordreset."); final String eMailAddress = getFormData(userCredentials, "email", true, "ui.passwordreset."); - final String firstName = getFormData(userCredentials, "firstname", true, "ui.passwordreset."); - final String lastName = getFormData(userCredentials, "lastname", true, "ui.passwordreset."); - User userByName = userDao.findByName(userName); - if (userByName == null) { - LOGGER.info("User not found: {}", userName); - return result; - } - if (!userByName.getEmail().equals(eMailAddress)) { - LOGGER.info("Wrong eMail provided for user '{}': {}", userName, eMailAddress); - return result; - } - if (!userByName.getFirstname().equals(firstName) || - !userByName.getLastname().equals(lastName)) { - LOGGER.info("Wrong first or last name provided for user '{}': {}, {}", userName, firstName, lastName); + User userByEmail = userDao.findByEMailAddress(eMailAddress); + if (userByEmail == null) { + LOGGER.info("User not found: {}", eMailAddress); return result; } resetPasswordRequestDao.deleteExpiredRequests(); // get rid of all expired requests // if there is already a request pending do not allow to add a new one - if (resetPasswordRequestDao.getByUserId(userByName.getId()) != null) { + if (resetPasswordRequestDao.getByUserId(userByEmail.getId()) != null) { result.put("message", "ui.passwordreset.already_present"); LOGGER.info("A non-expired password request is already present in the database for user: {}", userName); return result; @@ -465,7 +453,7 @@ public Map reset(@RequestBody Map userCredentials, ResetPasswordRequest request = new ResetPasswordRequest(); request.setToken(token); - request.setUserId(userByName.getId()); + request.setUserId(userByEmail.getId()); request.setExpirationDate(expirationDate); resetPasswordRequestDao.save(request); @@ -473,14 +461,14 @@ public Map reset(@RequestBody Map userCredentials, final SimpleDateFormat dateFormat = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss"); final String nowString = dateFormat.format(now); final String expirationDateString = dateFormat.format(expirationDate); - final String linkString = "http://" + serverAddress + "/user/activation/" + token; + final String linkString = "https://" + serverAddress + "/user/activation/" + token; - final String messageBody = "Sie haben ihr Passwort bei Arachne am " + nowString + " zurückgesetzt." - + newLine + "Bitte folgen sie diesem Link um den Prozess abzuschließen: " + linkString - + newLine + "Dieser Link ist bis zum " + expirationDateString + " gültig."; + final String messageBody = "A password reset was requested for iDAI.objects/Arachne on " + nowString + "." + + newLine + "You can use the following link to reset your password: " + linkString + + newLine + "The link is valid until " + expirationDateString + "."; - if (!isTestUser(userByName) && !mailService.sendMail(userByName.getEmail(), "Passwort zurückgesetzt bei Arachne", messageBody)) { - LOGGER.error("Unable to send password activation eMail to user: " + userByName.getEmail()); + if (!isTestUser(userByEmail) && !mailService.sendMail(userByEmail.getEmail(), "Passwort zurückgesetzt bei Arachne", messageBody)) { + LOGGER.error("Unable to send password activation eMail to user: " + userByEmail.getEmail()); resetPasswordRequestDao.delete(request); result.put("success", "false"); response.setStatus(400); diff --git a/frontend/app/users/pwd-reset.html b/frontend/app/users/pwd-reset.html index 99d4c7fbe..b2aa0746b 100644 --- a/frontend/app/users/pwd-reset.html +++ b/frontend/app/users/pwd-reset.html @@ -1,47 +1,32 @@
-
+

{{'ui.passwordreset.reset'|transl8}}

- -
- -
- -
-
- -
- -
+ +
+ +
- -
- -
-
- -
- -
+
+
+ +
+
-
-
- -
-
-
-
-
- -
-
+
+ +
+
\ No newline at end of file diff --git a/frontend/app/users/pwd-reset.resource.js b/frontend/app/users/pwd-reset.resource.js index 6e1f3f587..c26b38f8b 100644 --- a/frontend/app/users/pwd-reset.resource.js +++ b/frontend/app/users/pwd-reset.resource.js @@ -1,10 +1,10 @@ -export default function($resource, arachneSettings) { +export default function ($resource, arachneSettings) { return $resource(arachneSettings.dataserviceUri + '/user/reset', {}, { - save : { + save: { isArray: false, method: 'POST', - headers: {'Content-Type': 'application/json'} + headers: { 'Content-Type': 'application/json' } } }); };