src/Controller/SecurityController.php line 36

Open in your IDE?
  1. <?php
  3. namespace App\Controller;
  5. use App\Entity\User;
  6. use App\Form\{ForgotPasswordType, ResetPasswordType};
  7. use App\Repository\UserRepository;
  8. use Doctrine\ORM\EntityManagerInterface;
  9. use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
  10. use Symfony\Component\HttpFoundation\{Request, Response};
  11. use Symfony\Component\PasswordHasher\Hasher\UserPasswordHasherInterface;
  12. use Symfony\Component\Routing\Annotation\Route;
  13. use Symfony\Component\Security\Http\Authentication\AuthenticationUtils;
  14. use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
  15. use Symfony\Component\Security\Core\Exception\UserNotFoundException;
  17. class SecurityController extends AbstractController
  18. {
  19.     #[Route(path: '/login', name: 'app_login')]
  20.     public function login(AuthenticationUtils $helper): Response
  21.     {
  22.         $this->redirectLoggedInUsers();
  24.         return $this->render('security/login.html.twig', [
  25.             'last_username' => $helper->getLastUsername(),
  26.             'error' => $helper->getLastAuthenticationError()
  27.         ]);
  28.     }
  30.     #[Route(path: '/logout', name: 'app_logout', methods: ['GET'])]
  31.     public function logout(): void
  32.     {
  33.     }
  35.     #[Route(path: '/forgot-password', name: 'app_forgot')]
  36.     public function forgotPassword(Request $request, UserRepository $userRepo, EntityManagerInterface $entityManager): Response
  37.     {
  38.         $this->redirectLoggedInUsers();
  40.         if ($request->isMethod('POST')) {
  41.             $token = $request->request->get('g-recaptcha-response');
  42.             $responses = $this->verifyGoogleRecaptcha($token);
  43.             if (!$responses['success']) {
  44.                 throw new UserNotFoundException();
  45.             }
  46.         }
  48.         $form = $this->createForm(ForgotPasswordType::class);
  49.         $form->handleRequest($request);
  51.         if ($form->isSubmitted() && $form->isValid()) {
  52.             $user = $userRepo->findOneByEmail($form->get('email')->getData());
  53.             if (!$user) {
  54.                 $this->addFlash('success', 'An email with a link reset password is your email address!');
  55.                 return $this->redirectToRoute('app_login');
  56.             }
  57.             $user->setToken(bin2hex(random_bytes(32)));
  58.             $entityManager->persist($user);
  59.             $entityManager->flush();
  60.             $link = $this->generateUrl('user_reset_password', ['token' => $user->getToken()], UrlGeneratorInterface::ABSOLUTE_URL);
  61.             $html = '';
  62.             $html .= "<html>";
  63.             $html .= "<body style='background-color:#ffffff;color:black;font-family:Arial, 'Helvetica Neue',Helvetica, sans-serif;font-size: 13px;'>";
  64.             $html .= "Click <a href='" . $link . "' target='_blank'>here</a> to reset your password. This link is valid for 5 minutes.</body>";
  65.             $html .= "</html>";
  66.             $arrParams = '{"personalizations":[{"to":[{"email":"' . $form->get('email')->getData() . '"}],"subject":"Hospital Management System - Reset Password"}],"content": [{"type": "text/html charset=utf-8", "value": "' . $html . '"}],"from":{"email":"' . $_ENV['EMAIL_NOREPLY'] . '",
  67.             "name":"' . $_ENV['EMAIL_FROM_NAME'] . '"}}';
  68.             $endpoint = $_ENV['CNMGTS_API_MAIL_URL'];
  69.             $APItoken = 'Bearer ' . $_ENV['CNMGTS_API_MAIL_PASSWORD'];
  70.             $ch = @curl_init();
  71.             @curl_setopt($ch, CURLOPT_POST, true);
  72.             @curl_setopt($ch, CURLOPT_POSTFIELDS, $arrParams);
  73.             @curl_setopt($ch, CURLOPT_URL, $endpoint);
  74.             @curl_setopt($ch, CURLOPT_HTTPHEADER, array(
  75.                 'Authorization:' . $APItoken,
  76.                 'Content-Type: application/json',
  77.             ));
  78.             @curl_setopt($ch, CURLOPT_TIMEOUT, 400);
  79.             @curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  80.             $response = @curl_exec($ch); //Log the response from HubSpot as needed.
  81.             @curl_close($ch);
  83.             if ($response) {
  84.                 $this->addFlash('error', 'Please try again');
  85.                 return $this->redirectToRoute('app_forgot');
  86.             } else {
  87.                 $this->addFlash('success', 'An email with a link reset password is your email address!');
  88.                 return $this->redirectToRoute('app_login');
  89.             }
  90.         }
  92.         return $this->renderForm('security/forgot.html.twig', [
  93.             'form' => $form
  94.         ]);
  95.     }
  97.     #[Route(path: '/reset-password/{token}', name: 'user_reset_password')]
  98.     public function resetPassword(Request $request, User $user, string $token, UserPasswordHasherInterface $hasher, UserRepository $userRepo, EntityManagerInterface $entityManager): Response
  99.     {
  100.         $this->redirectLoggedInUsers();
  101.         $user = $userRepo->findOneBy(['token' => $token, 'isActive' => true]);
  102.         $form = $this->createForm(ResetPasswordType::class, $user);
  103.         $form->handleRequest($request);
  104.         if ($user) {
  105.             $getDate = $userRepo->ExpiryToken($token);
  106.             $newTime = date('Y-m-d H:i:s', strtotime('+5 minutes', strtotime($getDate)));
  107.             $time = time();
  108.             if ($time > strtotime($newTime)) {
  109.                 $this->addFlash('danger', 'Link expired! Please try again.');
  110.                 return $this->redirectToRoute('app_forgot');
  111.             } else {
  112.                 if ($form->isSubmitted() && $form->isValid()) {
  113.                     $first = $request->request->get('reset_password')['password']['first'];
  114.                     $second = $request->request->get('reset_password')['password']['second'];
  115.                     $formData = $form->getData();
  116.                     $newPassword = $user->getPassword();
  117.                     if (empty($first) && empty($second)) {
  118.                         return $this->renderForm('security/reset.html.twig', [
  119.                             'form' => $form,
  120.                             'error' => 'Password is required'
  121.                         ]);
  122.                     }
  123.                     if (preg_match('/^(?=.*\d)(?=.*[@#\-_$%^&+=§!\?])(?=.*[a-z])(?=.*[A-Z])[0-9A-Za-z@#\-_$%^&+=§!\?]{8,20}$/', $user->getPassword())) {
  124.                         if ($user->getPasswordMd5() != '' && $user->getPasswordMd5() == md5($newPassword)) {
  125.                             return $this->renderForm('security/reset.html.twig', [
  126.                                 'form' => $form,
  127.                                 'error' => 'Password should not be older password. please try again'
  128.                             ]);
  129.                         } elseif ($user->getPasswordOld1() != '' && ($user->getPasswordOld1() == md5($newPassword))) {
  130.                             return $this->renderForm('security/reset.html.twig', [
  131.                                 'form' => $form,
  132.                                 'error' => 'Password should not be older password. please try again'
  133.                             ]);
  134.                         } elseif ($user->getPasswordOld2() != '' && $user->getPasswordOld2() == md5($newPassword)) {
  135.                             return $this->renderForm('security/reset.html.twig', [
  136.                                 'form' => $form,
  137.                                 'error' => 'Password should not be older password. please try again'
  138.                             ]);
  139.                         } else {
  140.                             $userRepo->UpdatePassword1($user->getPasswordMd5(), $user->getId());
  141.                             $userRepo->UpdatePassword2($user->getPasswordOld1(), $user->getId());
  142.                             $userRepo->UpdatePassword3($user->getPasswordOld2(), $user->getId());
  143.                             $user->setPassword($hasher->hashPassword($user, $newPassword));;
  144.                             $user->setPasswordMd5(md5($newPassword));
  145.                             $user->setToken(null);
  146.                             $entityManager->persist($user);
  147.                             $entityManager->flush();
  148.                             $this->addFlash('success', 'Password updated successfully!');
  149.                             return $this->redirectToRoute('app_login');
  150.                         }
  151.                     } else {
  152.                         return $this->renderForm('security/reset.html.twig', [
  153.                             'form' => $form,
  154.                             'error' => 'Password is not valid. please try again'
  155.                         ]);
  156.                     }
  157.                 } else {
  158.                     return $this->renderForm('security/reset.html.twig', [
  159.                         'form' => $form,
  160.                         'error' => ''
  161.                     ]);
  162.                 }
  163.             }
  164.         }
  165.         return $this->redirectToRoute('app_forgot');
  166.     }
  168.     private function redirectLoggedInUsers()
  169.     {
  170.         if ($this->isGranted('IS_AUTHENTICATED_REMEMBERED')) {
  171.             return $this->redirectToRoute('dashboard');
  172.         }
  173.     }
  175.     public function verifyGoogleRecaptcha($token)
  176.     {
  177.         $ip2020 = "";
  178.         if (!empty($_SERVER['HTTP_CLIENT_IP'])) {
  179.             $ip2020 = $_SERVER['HTTP_CLIENT_IP'];
  180.         } elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
  181.             $ip2020 = $_SERVER['HTTP_X_FORWARDED_FOR'];
  182.         } else {
  183.             $ip2020 = $_SERVER['REMOTE_ADDR'];
  184.         }
  185.         $endpoint = 'https://www.google.com/recaptcha/api/siteverify';
  186.         $secretKey = $_ENV['GOOGLE_RECAPTCHA_SECRET_KEY'];
  187.         $arrParams = "secret=$secretKey" . "&response=$token" . "&remoteip=$ip2020";
  188.         $ch = @curl_init();
  189.         @curl_setopt($ch, CURLOPT_POST, true);
  190.         @curl_setopt($ch, CURLOPT_POSTFIELDS, $arrParams);
  191.         @curl_setopt($ch, CURLOPT_URL, $endpoint);
  192.         @curl_setopt($ch, CURLOPT_HTTPHEADER, array(
  193.             'Content-Type: application/x-www-form-urlencoded'
  194.         ));
  195.         @curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  196.         $response    = @curl_exec($ch); //Log the response from HubSpot as needed.
  197.         @curl_close($ch);
  198.         return json_decode($response, true);
  199.     }
  200. }