Added an setting to disable password reset mechanism.

By default the pw reset is disabled, when no email server is configured.

src/Controller/SecurityController.php

@@ -30,8 +30,10 @@ use Symfony\Component\Form\Extension\Core\Type\RepeatedType;
 use Symfony\Component\Form\Extension\Core\Type\SubmitType;
 use Symfony\Component\Form\Extension\Core\Type\TextType;
 use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 use Symfony\Component\Mailer\MailerInterface;
 use Symfony\Component\Routing\Annotation\Route;
+use Symfony\Component\Security\Core\Exception\AccessDeniedException;
 use Symfony\Component\Security\Http\Authentication\AuthenticationUtils;
 use Symfony\Component\Validator\Constraints\Length;
 use Symfony\Component\Validator\Constraints\NotBlank;
@@ -40,10 +42,12 @@ use Symfony\Contracts\Translation\TranslatorInterface;
 class SecurityController extends AbstractController
 {
     protected $translator;
+    protected $allow_email_pw_reset;
 
-    public function __construct(TranslatorInterface $translator)
+    public function __construct(TranslatorInterface $translator, bool $allow_email_pw_reset)
     {
         $this->translator = $translator;
+        $this->allow_email_pw_reset = $allow_email_pw_reset;
     }
 
     /**
@@ -68,6 +72,14 @@ class SecurityController extends AbstractController
      */
     public function requestPwReset(PasswordResetManager $passwordReset, Request $request)
     {
+        if (!$this->allow_email_pw_reset) {
+            throw new AccessDeniedHttpException("The password reset via email is disabled!");
+        }
+
+        if ($this->isGranted('IS_AUTHENTICATED_REMEMBERED')) {
+            throw new AccessDeniedHttpException("You are already logged in, so you can not reset your password!");
+        }
+
         $builder = $this->createFormBuilder();
         $builder->add('user', TextType::class, [
             'label' => $this->translator->trans('pw_reset.user_or_password'),
@@ -88,7 +100,7 @@ class SecurityController extends AbstractController
         if ($form->isSubmitted() && $form->isValid()) {
             $passwordReset->request($form->getData()['user']);
             $this->addFlash('success', $this->translator->trans('pw_reset.request.success'));
-            //return $this->redirectToRoute('login');
+            return $this->redirectToRoute('login');
         }
 
         return $this->render('security/pw_reset_request.html.twig', [
@@ -101,6 +113,14 @@ class SecurityController extends AbstractController
      */
     public function pwResetNewPw(PasswordResetManager $passwordReset, Request $request, string $user = null, string $token = null)
     {
+        if (!$this->allow_email_pw_reset) {
+            throw new AccessDeniedHttpException("The password reset via email is disabled!");
+        }
+
+        if ($this->isGranted('IS_AUTHENTICATED_REMEMBERED')) {
+            throw new AccessDeniedHttpException("You are already logged in, so you can not reset your password!");
+        }
+
         $data = ['username' => $user, 'token' => $token];
         $builder = $this->createFormBuilder($data);
         $builder->add('username', TextType::class, [

src/Services/CustomEnvVarProcessor.php

@@ -0,0 +1,55 @@
+<?php
+/**
+ * This file is part of Part-DB (https://github.com/Part-DB/Part-DB-symfony).
+ *
+ * Copyright (C) 2019 Jan Böhmer (https://github.com/jbtronics)
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA
+ */
+
+namespace App\Services;
+
+
+use Symfony\Component\DependencyInjection\EnvVarProcessorInterface;
+use Symfony\Component\DependencyInjection\Exception\EnvNotFoundException;
+
+class CustomEnvVarProcessor implements EnvVarProcessorInterface
+{
+
+    /**
+     * @inheritDoc
+     */
+    public function getEnv($prefix, $name, \Closure $getEnv)
+    {
+        if ('validMailDSN' === $prefix) {
+            try {
+                $env = $getEnv($name);
+                return !empty($env)  && $env !== 'null://null';
+            } catch (EnvNotFoundException $exception) {
+                return false;
+            }
+        }
+    }
+
+    /**
+     * @inheritDoc
+     */
+    public static function getProvidedTypes()
+    {
+        return [
+            'validMailDSN' => 'bool',
+        ];
+    }
+}