How is a CAPTCHA checked when a backend user resets its password on the backend authentication page?

dmitry_fedyuk · March 4, 2016, 2:37am

magento/magento2/blob/cf7df72/app/code/Magento/Captcha/etc/adminhtml/events.xml#L9-L11


<event name="controller_action_predispatch_adminhtml_auth_forgotpassword">
    <observer name="captcha" instance="Magento\Captcha\Observer\CheckUserForgotPasswordBackendObserver" />
</event>

github.com

magento/magento2/blob/cf7df72/app/code/Magento/Captcha/etc/adminhtml/di.xml#L21-L25


<type name="Magento\Captcha\Observer\CheckUserForgotPasswordBackendObserver">
    <arguments>
        <argument name="session" xsi:type="object">Magento\Backend\Model\Session</argument>
    </arguments>
</type>

github.com

magento/magento2/blob/cf7df72/app/code/Magento/Captcha/Observer/CheckUserForgotPasswordBackendObserver.php#L65-L85


public function execute(\Magento\Framework\Event\Observer $observer)
{
    $formId = 'backend_forgotpassword';
    $captchaModel = $this->_helper->getCaptcha($formId);
    $controller = $observer->getControllerAction();
    $email = (string)$observer->getControllerAction()->getRequest()->getParam('email');
    $params = $observer->getControllerAction()->getRequest()->getParams();
    if (!empty($email) && !empty($params)) {
        if ($captchaModel->isRequired()) {
            if (
                !$captchaModel->isCorrect($this->captchaStringResolver->resolve($controller->getRequest(), $formId))
            ) {
                $this->_session->setEmail((string)$controller->getRequest()->getPost('email'));
                $this->_actionFlag->set('', \Magento\Framework\App\Action\Action::FLAG_NO_DISPATCH, true);
                $this->messageManager->addError(__('Incorrect CAPTCHA'));
                $controller->getResponse()->setRedirect(
                    $controller->getUrl('*/*/forgotpassword', ['_nosecret' => true])
                );
            }
        }
    }

dmitry_fedyuk · March 5, 2016, 12:04am