CODEWITHSUNDEEP
phpauthenticationlaravel-5laravel-authorization
Vojta
Vojta

Reputation: 379

Deny password reset in Laravel

I'm trying to add rule to custom password reset logic in Laravel. I don't want to allow all users to reset password and gain access to the application as some of them are suspended.

I created new rule in Laravel which ensures that, however I don't know where to put it. I would like to validate such users as soon as they enter their email and hit "send me password reset link" So they won't even receive reset password email.

where do I put this logic? I tried to put it in constructor in Http/Controllers/Auth/ResetPasswordController.php but with no luck.

Thank you

Upvotes: 1

Views: 455

Answers (1)

PedroFTW
PedroFTW

Reputation: 84

You can do the following:

The ForgotPasswordController class is the one who controls wether or not the email will be sent. It implements the SendsPasswordResetEmails trait as seen here:

namespace App\Http\Controllers\Auth;

use App\Http\Controllers\Controller;

// Adds SendsPasswordResetEmails to the scope
use Illuminate\Foundation\Auth\SendsPasswordResetEmails;

class ForgotPasswordController extends Controller
{
    [...]
    // It uses the SendsPasswordResetEmails Trait
    use SendsPasswordResetEmails;

This trait implements a few methods: The showLinkRequestForm() (wich shows the password reset view), and the one that is important to you: the validateEmail() method, wich checks if the email is valid.

You can override it in the SendsPasswordResetEmails like this:

namespace App\Http\Controllers\Auth;

// You will have to add the Request class to the scope
use Illuminate\Http\Request;
use App\Http\Controllers\Controller;
use Illuminate\Foundation\Auth\ResetsPasswords;

class ResetPasswordController extends Controller
{
[...]

protected function validateEmail(Request $request)
    {
        $this->validate($request, [
            // Pass an instance of your rule to the validation array
            'email' => ['required|email', new YourSpecificRuleHere]
        ]);
    }

This should do the trick, if the email doesn't apply to the rule, the form will return the message "Your account has been suspended". Just don't forget to use the Request class as indicated in the begginint of the last script!

Hope it helps!

Upvotes: 1

Related Questions