<commit_before><?php

/**
 *    Copyright (c) ppy Pty Ltd <<EMAIL>>.
 *
 *    This file is part of osu!web. osu!web is distributed with the hope of
 *    attracting more community contributions to the core ecosystem of osu!.
 *
 *    osu!web is free software: you can redistribute it and/or modify
 *    it under the terms of the Affero GNU General Public License version 3
 *    as published by the Free Software Foundation.
 *
 *    osu!web is distributed WITHOUT ANY WARRANTY; without even the implied
 *    warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 *    See the GNU Affero General Public License for more details.
 *
 *    You should have received a copy of the GNU Affero General Public License
 *    along with osu!web.  If not, see <http://www.gnu.org/licenses/>.
 */

namespace App\Http\Controllers;

use App\Mail\PasswordReset;
use App\Models\User;
use App\Models\UserAccountHistory;
use Carbon\Carbon;
use Mail;
use Request;
use Session;

class PasswordResetController extends Controller
{
    protected $section = 'home';
    protected $actionPrefix = 'password-reset-';

    public function __construct()
    {
        parent::__construct();

        $this->middleware('guest');
        $this->middleware('throttle:60,10');
    }

    public function destroy()
    {
        $this->clear();

        return ujs_redirect(route('password-reset'));
    }

    public function index()
    {
        $isStarted = Session::exists('password_reset');

        return view('password_reset.index', compact('isStarted'));
    }

    public function create()
    {
        $error = $this->issue(Request::input('username'));

        if ($error === null) {
            return ['message' => trans('password_reset.notice.sent')];
        } else {
            return response(['form_error' => [
                'username' => [$error],
            ]], 422);
        }
    }

    public function update()
    {
        $session = Session::get('password_reset');
        $user = User::find($session['user_id']);
        $inputKey = str_replace(' ', '', Request::input('key'));

        if ($user === null) {
            return $this->restart('invalid');
        }

        if ($session['expire']->isPast()) {
            return $this->restart('expired');
        }

        if (!present($inputKey)) {
            return response(['form_error' => [
                'key' => [trans('password_reset.error.missing_key')],
            ]], 422);
        }

        if (!hash_equals($session['key'], $inputKey)) {
            // wrong key
            $tries = $session['tries'] + 1;

            if ($tries >= config('osu.user.password_reset.tries')) {
                return $this->restart('too_many_tries');
            }

            Session::put('password_reset.tries', $tries);

            return response(['form_error' => [
                'key' => [trans('password_reset.error.wrong_key')],
            ]], 422);
        }

        $params = get_params(request(), 'user', ['password', 'password_confirmation']);
        $user->validatePasswordConfirmation();

        if ($user->update($params)) {
            $this->clear();
            $this->login($user);

            UserAccountHistory::logUserResetPassword($user);

            return ['message' => trans('password_reset.notice.saved')];
        } else {
            return response(['form_error' => [
                'user' => $user->validationErrors()->all(),
            ]], 422);
        }
    }

    private function clear()
    {
        Session::forget('password_reset');
    }

    private function issue($username)
    {
        $user = User::findForLogin($username);

        if ($user === null) {
            return trans('password_reset.error.user_not_found');
        }

        if (!present($user->user_email)) {
            return trans('password_reset.error.contact_support');
        }

        if ($user->isPrivileged()) {
            return trans('password_reset.error.is_privileged');
        }

        $session = [
            'username' => $username,
            'user_id' => $user->user_id,
            'key' => bin2hex(random_bytes(config('osu.user.password_reset.key_length') / 2)),
            'expire' => Carbon::now()->addHours(config('osu.user.password_reset.expires_hour')),
            'tries' => 0,
        ];

        Session::put('password_reset', $session);

        Mail::to($user->user_email)->send(new PasswordReset([
            'user' => $user,
            'key' => $session['key'],
        ]));
    }

    private function restart($reasonKey)
    {
        $this->clear();

        return ['message' => trans("password_reset.restart.{$reasonKey}")];
    }
}<commit_msg>allow password reset if user_password is empty string<commit_after><?php

/**
 *    Copyright (c) ppy Pty Ltd <<EMAIL>>.
 *
 *    This file is part of osu!web. osu!web is distributed with the hope of
 *    attracting more community contributions to the core ecosystem of osu!.
 *
 *    osu!web is free software: you can redistribute it and/or modify
 *    it under the terms of the Affero GNU General Public License version 3
 *    as published by the Free Software Foundation.
 *
 *    osu!web is distributed WITHOUT ANY WARRANTY; without even the implied
 *    warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
 *    See the GNU Affero General Public License for more details.
 *
 *    You should have received a copy of the GNU Affero General Public License
 *    along with osu!web.  If not, see <http://www.gnu.org/licenses/>.
 */

namespace App\Http\Controllers;

use App\Mail\PasswordReset;
use App\Models\User;
use App\Models\UserAccountHistory;
use Carbon\Carbon;
use Mail;
use Request;
use Session;

class PasswordResetController extends Controller
{
    protected $section = 'home';
    protected $actionPrefix = 'password-reset-';

    public function __construct()
    {
        parent::__construct();

        $this->middleware('guest');
        $this->middleware('throttle:60,10');
    }

    public function destroy()
    {
        $this->clear();

        return ujs_redirect(route('password-reset'));
    }

    public function index()
    {
        $isStarted = Session::exists('password_reset');

        return view('password_reset.index', compact('isStarted'));
    }

    public function create()
    {
        $error = $this->issue(Request::input('username'));

        if ($error === null) {
            return ['message' => trans('password_reset.notice.sent')];
        } else {
            return response(['form_error' => [
                'username' => [$error],
            ]], 422);
        }
    }

    public function update()
    {
        $session = Session::get('password_reset');
        $user = User::find($session['user_id']);
        $inputKey = str_replace(' ', '', Request::input('key'));

        if ($user === null) {
            return $this->restart('invalid');
        }

        if ($session['expire']->isPast()) {
            return $this->restart('expired');
        }

        if (!present($inputKey)) {
            return response(['form_error' => [
                'key' => [trans('password_reset.error.missing_key')],
            ]], 422);
        }

        if (!hash_equals($session['key'], $inputKey)) {
            // wrong key
            $tries = $session['tries'] + 1;

            if ($tries >= config('osu.user.password_reset.tries')) {
                return $this->restart('too_many_tries');
            }

            Session::put('password_reset.tries', $tries);

            return response(['form_error' => [
                'key' => [trans('password_reset.error.wrong_key')],
            ]], 422);
        }

        $params = get_params(request(), 'user', ['password', 'password_confirmation']);
        $user->validatePasswordConfirmation();

        if ($user->update($params)) {
            $this->clear();
            $this->login($user);

            UserAccountHistory::logUserResetPassword($user);

            return ['message' => trans('password_reset.notice.saved')];
        } else {
            return response(['form_error' => [
                'user' => $user->validationErrors()->all(),
            ]], 422);
        }
    }

    private function clear()
    {
        Session::forget('password_reset');
    }

    private function issue($username)
    {
        $user = User::findForLogin($username);

        if ($user === null) {
            return trans('password_reset.error.user_not_found');
        }

        if (!present($user->user_email)) {
            return trans('password_reset.error.contact_support');
        }

        if ($user->isPrivileged() && $user->user_password !== '') {
            return trans('password_reset.error.is_privileged');
        }

        $session = [
            'username' => $username,
            'user_id' => $user->user_id,
            'key' => bin2hex(random_bytes(config('osu.user.password_reset.key_length') / 2)),
            'expire' => Carbon::now()->addHours(config('osu.user.password_reset.expires_hour')),
            'tries' => 0,
        ];

        Session::put('password_reset', $session);

        Mail::to($user->user_email)->send(new PasswordReset([
            'user' => $user,
            'key' => $session['key'],
        ]));
    }

    private function restart($reasonKey)
    {
        $this->clear();

        return ['message' => trans("password_reset.restart.{$reasonKey}")];
    }
}
{'fraction_non_alphanumeric': 0.15104332168202522, 'fraction_numerical': 0.0044486812837623135, 'mean_word_length': 2.2682589131187263, 'pattern_counts': {'":': 0, '<': 11, '<?xml version=': 0, '>': 90, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '363865', 'n_tokens_mistral': 2719, 'n_tokens_neox': 2591, 'n_words': 582}