Wrong format in check_email template?

[lukepass]

Hello, this is the current check_email template:

{% extends 'base.html.twig' %}

{% block title %}Password Reset Email Sent{% endblock %}

{% block body %}
    <p>An email has been sent that contains a link that you can click to reset your password. This link will expire in {{ tokenLifetime|date('g') }} hour(s).</p>
    <p>If you don't receive an email please check your spam folder or <a href="{{ path('app_forgot_password_request') }}">try again</a>.</p>
{% endblock %}

This prints the message:

An email has been sent that contains a link that you can click to reset your password. This link will expire in 2 hour(s).

Which is wrong because in the email I get "1 hour".

The problem is that tokenLifetime contains "3600" and it's not a timestamp (thus cannot be converted to date?).

Thanks.

[jrushlow]

Good Morning @lukepass, we've had a long standing issue in this bundle with the time shown in the template. That has been fixed with the v1.2.2 release of ResetPasswordBundle. At the same time we've updated the templates for both ResetPasswordBundle & VerifyEmailBundle in Symfony's MakerBundle to utilize translations and fix the incorrect expiration time.

To fix this issue in existing projects:

See examples below...

[lukepass]

Hello and thanks for the quick answer!

Unfortunately in my checkEmail action I don't have access to resetToken:

public function checkEmail(): Response
{
    // We prevent users from directly accessing this page
    if (!$this->canCheckEmail()) {
        return $this->redirectToRoute('app_forgot_password_request');
    }

    return $this->render('reset_password/check_email.html.twig', [
        'tokenLifetime' => $this->resetPasswordHelper->getTokenLifetime(),
    ]);
}

[jrushlow]

Ahhh - I missed the link that is displayed in the /check-email route. The fix above is for the email itself. I'll get an update pushed out in the next couple hours. Stay tuned!

[jrushlow]

Examples updated for use with ResetPasswordBundle v1.3.0

To fix this issue in existing projects:

1. Run composer update to upgrade to the latest versions of ResetPasswordBundle & MakerBundle
2. Manually update the following files that were generated by make:reset-password

// ResetPasswordController::class
...

    public function checkEmail(): Response
    {
        // We prevent users from directly accessing this page
-     if (!$this->canCheckEmail()) {
+     if (null === ($resetToken = $this->getTokenObjectFromSession())) {
            return $this->redirectToRoute('app_forgot_password_request');
        }

        return $this->render('reset_password/check_email.html.twig', [
-            'tokenLifetime' => $this->resetPasswordHelper->getTokenLifetime(),
+            'resetToken' => $resetToken,
        ]);
    }

    private function processSendingPasswordResetEmail(string $emailFormData, MailerInterface $mailer): RedirectResponse
    {
        $user = $this->getDoctrine()->getRepository(<?= $user_class_name ?>::class)->findOneBy([
            '<?= $email_field ?>' => $emailFormData,
        ]);

-       // Marks that you are allowed to see the app_check_email page.
-       $this->setCanCheckEmailInSession();

...          

        $email = (new TemplatedEmail())
            ->from(new Address('<?= $from_email ?>', '<?= $from_email_name ?>'))
            ->to($user-><?= $email_getter ?>())
            ->subject('Your password reset request')
            ->htmlTemplate('reset_password/email.html.twig')
            ->context([
                'resetToken' => $resetToken,
            ])
        ;

        $mailer->send($email);

+       // Store the token object in session for retrieval in check-email route.
+       $this->setTokenObjectInSession($resetToken);
+
         return $this->redirectToRoute('app_check_email');
    }

// src/templates/reset-password/email.twig.html


-    <p>This link will expire in {{ tokenLifetime|date('g') }} hour(s).</p>
+    <p>This link will expire in {{ resetToken.expirationMessageKey|trans(resetToken.expirationMessageData, 'ResetPasswordBundle') }}.</p>

// src/templates/reset-password/check_email.html.twig

-    <p>An email has been sent that contains a link that you can click to reset your password. This link will expire in {{ tokenLifetime|date('g') }} hour(s).</p>
+    <p>
+       An email has been sent that contains a link that you can click to reset your password.
+       This link will expire in {{ resetToken.expirationMessageKey|trans(resetToken.expirationMessageData, 'ResetPasswordBundle') }}.
+    </p>
    <p>If you don't receive an email please check your spam folder or <a href="{{ path('app_forgot_password_request') }}">try again</a>.</p>

You should then be all set! If you run into any trouble, let us know if you have any issues and thanks for using ResetPasswordBundle!

[jrushlow]

@lukepass I've refactored the example above to reflect the changes that will be coming in the next MakerBundle release. In the meantime, the above should take care of both templates. Thanks for bringing this to our attention!

[lukepass]

I think that there are other cases where you would be redirected to app_check_email without a token, for example:

    // Do not reveal whether a user account was found or not.
    if (!$user) {
        return $this->redirectToRoute('app_check_email');
    }

This wouldn't work (you are not passing the token) and it would redirect back to registration.

Moreover passing parameters with redirectToRoute doesn't seem to work and $resetToken is always null in the checkEmail action.

Thanks again.

[jrushlow]

@lukepass we just released v1.3.0 which adds getter/setters in the ResetPasswordControllerTrait::class to persist the ResetPasswordToken object into tthe session. I've also refactored the example above to use the new methods. This should take care of the issue.

Checkout https://github.com/SymfonyCasts/reset-password-bundle/releases/tag/v1.3.0 for full release details! Template updates in MakerBundle are soon to follow.

[lukepass]

Thank you, now it seems fixed. However in this new version if I insert an email address which doesn't exist I am always redirected to the app_forgot_password_request without any message.