Geek Answers Handbook

Disable FOS Single Password Function

I use the FOS package for users in Symfony, and I really dislike the fact that a user can only ask for a password once in 24 hours. Is there a way to disable this feature so that the user can request their password several times. I mean, what happens if their reset email never reaches their inbox, and they cannot reset pw again, as the best way to handle this.

Thanks.

+5
source share
3 answers

In the FOSUserBundle configuration, there is a token_ttl parameter, which has a default value of 86400. This is the number of seconds and it is used to determine the time to live for the token and the wait time of the user before retrying the request.

You can try setting 0 or false, it should work.

 fos_user: resetting: token_ttl: 0
+7
source

I found a problem with the changes below in config.yml

application / Config / config.yml

 fos_user: resetting: token_ttl: 0

This will allow the user to request a new password as many times as he wants (without a 24-hour limit), however, due to the zero waiting time for the token, he will automatically redirect you from

 /resetting/reset/{token}

to

 resetting/request

Thus, the user will never be given the opportunity to change his password.

This has been tested on symfony 2.6

+2
source

Once upon a time, you can just configure this in config.yml

 fos_user: resetting: token_ttl: 0

but in recent versions, since token_ttl and retry time and token lifetime, if you set it to 0, as soon as you create it, it expires.

You can complete the question on Github

If you need it to be fixed as possible as a hacker workaround , you can implement resetAction() by inserting vendor/friendsofsymfony/user-bundle/Controller/RegistrationController.php into your AppBundle (or any package that actually matters) and force the router to point to your overriden function, for example this (routing.yml):

 fos_user_resetting_reset: path: /resetting/reset/{token} defaults: {_controller: AcmeUserBundle:Resetting:reset }

Now, in your resetAction() method, you can comment on these lines:

 // if (null !== $event->getResponse()) { // return $event->getResponse(); // }

There are less hacker methods, of course, like creating your own listener, but ... I did it quickly and dirty, as I was in a hurry, and I already had the redirect reset.

+1
source

More articles:


All Articles