app/controllers/account_controller.rb
def lost_password
    return redirect_to(home_url) unless allow_lost_password_recovery?

    if params[:token]
      @token = ::Token::Recovery.find_by_plaintext_value(params[:token])
      redirect_to(home_url) && return unless @token and !@token.expired?
      @user = @token.user
      if request.post?
        call = ::Users::ChangePasswordService.new(current_user: @user, session: session).call(params)
        call.apply_flash_message!(flash)

        if call.success?
          @token.destroy
          redirect_to action: 'login'
          return
        end
      end

      render template: 'account/password_recovery'
    elsif request.post?
      mail = params[:mail]
      user = User.find_by_mail(mail) if mail.present?

      # Ensure the same request is sent regardless of which email is entered
      # to avoid detecability of mails
      flash[:notice] = l(:notice_account_lost_email_sent)

      unless user
        # user not found in db
        Rails.logger.error "Lost password unknown email input: #{mail}"
        return
      end

      unless user.change_password_allowed?
        # user uses an external authentification
        Rails.logger.error "Password cannot be changed for user: #{mail}"
        return
      end

      # create a new token for password recovery
      token = Token::Recovery.new(user_id: user.id)
      if token.save
        UserMailer.password_lost(token).deliver_now
        flash[:notice] = l(:notice_account_lost_email_sent)
        redirect_to action: 'login', back_url: home_url
        return
      end
    end
  end
# Enable user to choose a new password
Enable user to choose a new password
Enable user to choose a new password
def lost_password
    return redirect_to(home_url) unless allow_lost_password_recovery?
    if params[:token]
      @token = ::Token::Recovery.find_by_plaintext_value(params[:token])
      redirect_to(home_url) && return unless @token and !@token.expired?
      @user = @token.user
      if request.post?
        call = ::Users::ChangePasswordService.new(current_user: @user, session: session).call(params)
        call.apply_flash_message!(flash)
        if call.success?
          @token.destroy
          redirect_to action: 'login'
          return
        end
      end
      render template: 'account/password_recovery'
    elsif request.post?
      mail = params[:mail]
      user = User.find_by_mail(mail) if mail.present?
      flash[:notice] = l(:notice_account_lost_email_sent)
      unless user
        Rails.logger.error "Lost password unknown email input: #{mail}"
        return
      end
      unless user.change_password_allowed?
        Rails.logger.error "Password cannot be changed for user: #{mail}"
        return
      end
      token = Token::Recovery.new(user_id: user.id)
      if token.save
        UserMailer.password_lost(token).deliver_now
        flash[:notice] = l(:notice_account_lost_email_sent)
        redirect_to action: 'login', back_url: home_url
        return
      end
    end
  end
def lost_password return redirect_to ( home_url ) unless allow_lost_password_recovery? if params [ :token ] @token = :: Token :: Recovery . find_by_plaintext_value ( params [ :token ] ) redirect_to ( home_url ) && return unless @token and ! @token . expired? @user = @token . user if request . post? call = :: Users :: ChangePasswordService . new ( current_user : @user , session : session ) . call ( params ) call . apply_flash_message! ( flash ) if call . success? @token . destroy redirect_to action : 'login' return end end render template : 'account/password_recovery' elsif request . post? mail = params [ :mail ] user = User . find_by_mail ( mail ) if mail . present? flash [ :notice ] = l ( :notice_account_lost_email_sent ) unless user Rails . logger . error "Lost password unknown email input: #{mail}" return end unless user . change_password_allowed? Rails . logger . error "Password cannot be changed for user: #{mail}" return end token = Token :: Recovery . new ( user_id : user . id ) if token . save UserMailer . password_lost ( token ) . deliver_now flash [ :notice ] = l ( :notice_account_lost_email_sent ) redirect_to action : 'login' , back_url : home_url return end end end
Enable user to choose a new password
Enable user to choose a new password
# Ensure the same request is sent regardless of which email is entered # to avoid detecability of mails # user not found in db # user uses an external authentification # create a new token for password recovery