为登录用户设计忘记密码

Posted 2023-02-25

【中文标题】为登录用户设计忘记密码

【英文标题】：Devise Forgot Password for logged in user

【发布时间】：2012-02-16 13:16:13

【问题描述】：

我想知道是否有一种方法可以调用“忘记密码”程序而不强制我的用户退出

我遇到的情况是： 1. 用户使用 facebook 登录，为他们生成一个假密码 2. 然后用户想要更改他们的电子邮件/姓名/密码，或者只是使用非 facebook 登录

由于设计需要密码来更改这些字段，因此用户无法修改它们

我曾考虑过不强制设置密码，但这在安全方面没有意义，所以我只是将字段显示为文本并通知用户遵循“忘记密码”程序以设置密码，然后他们可以更改字段

然后的问题是我不能简单地从用户配置文件链接到这个，因为设计会告诉用户他们在已经登录时不能这样做。

那么有没有一种方法可以覆盖忘记密码或 /users/password/edit 方法，以便登录的用户也可以执行此操作？

【参考方案1】：

您无法重置密码的原因是因为该设备尝试使用当前会话对用户进行身份验证，并且当成功时，您会自动重定向到它应该去的任何路径。您需要覆盖密码控制器的编辑和更新操作以使其跳过此步骤。

这是代码。在您的密码控制器中添加以下代码（您可以要求设计为您生成控制器，或者您可以只创建以下控制器）。更新覆盖是必要的，否则登录用户将在您重置密码后自动注销。 （或者，如果您希望它是这样，您可以摆脱 #update 覆盖）

class PasswordsController < Devise::PasswordsController
  # here we need to skip the automatic authentication based on current session for the following two actions
  # edit: shows the reset password form. need to skip, otherwise it will go directly to root
  # update: updates the password, need to skip otherwise it won't even reset if already logged in
  skip_before_filter :require_no_authentication, :only => [:edit, :update]

  # we need to override the update, too.
  # After a password is reset, all outstanding sessions are gone.
  # When already logged in, sign_in is a no op, so the session will expire, too.
  # The solution is to logout and then re-login which will make the session right.
  def update
    super
    if resource.errors.empty?
      sign_out(resource_name)
      sign_in(resource_name, resource)
    end
  end
end

路线如下

# config/routes.rb
devise_for :users, :controllers => :passwords => 'passwords'

【讨论】：

将skip_before_filter 替换为skip_before_action 以匹配Rails4+ 语法。

【参考方案2】：

我在这里的完整解决方案，因为我还了解到用户在单击电子邮件中的链接后必须注销，因此添加了一些额外的 UserController 操作来实际编辑密码以及保存密码。这不是一个理想的解决方案，冷处理可能会以更好的方式完成，但它对我有用。

用户控制器；添加了重置方法

    before_filter :authenticate_user!, :except => [:do_reset_password, :reset_password_edit]

    def reset_password
        id = params[:id]
        if id.nil?
          id = current_user.id
        end    
        if (!user_signed_in? || current_user.id.to_s != id.to_s)
        flash[:alert] = "You don't have that right." 
          redirect_to '/home'
          return
        end

        @user = User.find(id)
        @user.send_reset_password_instructions

        respond_to do |format|
            format.html  redirect_to '/users/edit', notice: 'You will receive an email with instructions about how to reset your password in a few minutes.' 
        end
     end


    def do_reset_password
        id = params[:id]
        if id.nil? && !current_user.nil?
          id = current_user.id
        end

        if id.nil?
            @user = User.where(:reset_password_token => params[:user][:reset_password_token]).first
        else
            @user = User.find(id)
        end
        if  @user.nil? || @user.reset_password_token.to_s != params[:user][:reset_password_token]
          flash[:alert] = "Url to reset was incorrect, please resend reset email." 
          redirect_to '/home'
          return
        end

        # there may be a better way of doing this, devise should be able to give us these messages
        if params[:user][:password] != params[:user][:password_confirmation]
            flash[:alert] = "Passwords must match." 
              redirect_to :back
              return
        end
        if @user.reset_password!(params[:user][:password],params[:user][:password_confirmation])
            @user.hasSetPassword = true
            @user.save
            respond_to do |format|
                format.html  redirect_to '/home', notice: 'Your password has been changed.' 
            end
        else
            flash[:alert] = "Invalid password, must be at least 6 charactors." 
              redirect_to :back 
        end
    end

    def reset_password_edit
        @user = User.where(:reset_password_token => params[:reset_password_token]).first
        if  @user.nil? || !@user.reset_password_period_valid?
            flash[:alert] = "Password reset period expired, please resend reset email" 
            redirect_to "/home"
            return
        end
    end

视图/设计/注册/编辑；将视图更改为不允许用户编辑需要密码的字段

    <%= form_for(resource, :as => resource_name, :url => registration_path(resource_name), :html =>  :method => :put ) do |f| %>
      <%= devise_error_messages! %>

      <% if !resource.hasSetPassword %>                                           
          <%= f.label :name %><br />
          <p style="line-height:24px;"><b><%= @user.name %></b></p>             
          <div><%= f.label :email %><br />
              <p style="line-height:24px;"><b><%= @user.email %> </b></p>
              <p style="position:relative; left:150px; width:420px;">
                <i>you cannot change any settings because you have not set a password <br />yet, you can do so by following the </i>
                <%= link_to "Forgot your password", "/users/reset_password" %> <i> procedure</i>
              </p>
          </div>
      <% else %>                      
          <p><%= f.label :name %><br />
          <%= f.text_field :name %></p>         
          <div><%= f.label :email %><br />
          <%= f.email_field :email %></div>

          <div><%= f.label :password %> <br />
          <%= f.password_field :password %><i>(leave blank if you don't want to change it)</i></div>

          <div><%= f.label :password_confirmation %><br />
          <%= f.password_field :password_confirmation %></div>

          <div><%= f.label :current_password %> <br />
          <%= f.password_field :current_password %>
          <i>(we need your current password to confirm your changes)</i>
          </div>
        <div><%= f.submit "Update" %></div>
      <% end %>
    <% end %>

views/devise/mailer/reset_password_instructions;在我们的新案例中，必须将其更改为指向正确的 URL

    <p>Hello <%= @resource.email %>!</p>

    <p>Someone has requested a link to change your password, and you can do this through the link below.</p>

    <% if !@resource.hasSetPassword %>
        <p><%= link_to 'Change my password', 'http://streetsbehind.me/users/reset_password_edit?reset_password_token='[e-mail]_password_token %></p>
    <!-- todo: there's probably a better way of doing this than just hardcoding streetsbehind.me -->
    <% else %>
        <p><%= link_to 'Change my password', edit_password_url(@resource, :reset_password_token => @resource.reset_password_token) %></p>
    <% end %>
    <p>If you didn't request this, please ignore this email.</p>
    <p>Your password won't change until you access the link above and create a new one.</p>

views/users/reset_password_edit.erb

<%= form_for(@user, :url => url_for(:action => :do_reset_password) , :html =>  :method => :post ) do |f| %>

  <%= f.hidden_field :reset_password_token %>

  <div><%= f.label :password, "New password" %><br />
  <%= f.password_field :password %></div>

  <div><%= f.label :password_confirmation, "Confirm new password" %><br />
  <%= f.password_field :password_confirmation %></div>

  <div><%= f.submit "Change my password" %></div>
<% end %>

config/routes.rb

get "users/reset_password"
get "users/reset_password_edit"

resource :users do
  post 'do_reset_password'
end

【参考方案3】：

您可以使用@user.send_reset_password_instructions 生成密码重置令牌并发送电子邮件。如果您只是直接调用邮件程序，则不会生成密码重置令牌来验证重置。