Pippin pinned everyone's passwords on the order board, “so he wouldn't forget them”. It's urgent to change the locks: every staff member must be able to change their password.
Your mission
- Complete
ChangementMotDePasseType(password change), a form that fills no entity:ancien(old): the current password, checked (“This is not your current password.”);nouveau(new): entered twice (“The two entries do not match.”), required, at least 8 characters (“At least 8 characters.”).
- In
ProfilController::changerMotDePasse()(page/profile/password):- reserve the page for logged-in staff members;
- if the form is valid: hash the new password, save it, add the flash message “Password changed.”, then redirect to the home page.
To try it in the preview: log in with bruna@drunken-dragon.me / cauldron, then follow the “My password” link.
What about those who read the board?
On every request, the firewall reloads the staff member from the database and compares them with the one kept in the session. If the password is different, the account may have been compromised: the session is closed. So every session opened with the old password is logged out as soon as it changes, except yours: it stored the new hash at the end of the request. Symfony takes care of it on its own, and the tests check it.
Reminder
Symfony provides the UserPassword constraint, to check the current password, and the RepeatedType type, for the double entry. Never compare passwords yourself.