String changeKey = Util.getParam(params, CHANGE_KEY);
String template = Util.getParam(params, Params.TEMPLATE, PWD_CHANGED_XSLT);
// check valid user
final UserRepository userRepository = context.getBean(UserRepository.class);
User elUser = userRepository.findOneByUsername(username);
if (elUser == null) {
throw new UserNotFoundEx(username);
}
// only let registered users change their password this way
if ( elUser.getProfile() != Profile.RegisteredUser) {
throw new OperationNotAllowedEx("Only users with profile RegisteredUser can change their password using this option");
}
// construct expected change key - only valid today
String scrambledPassword = elUser.getPassword();
Calendar cal = Calendar.getInstance();
SimpleDateFormat sdf = new SimpleDateFormat(DATE_FORMAT);
String todaysDate = sdf.format(cal.getTime());
boolean passwordMatches = PasswordUtil.encoder(context.getServlet().getServletContext()).matches(scrambledPassword+todaysDate, changeKey);
//check change key
if (!passwordMatches)
throw new BadParameterEx("Change key invalid or expired", changeKey);
// get mail details
SettingManager sm = context.getBean(SettingManager.class);
String adminEmail = sm.getValue("system/feedback/email");
String thisSite = sm.getSiteName();
// get site URL
SettingInfo si = context.getBean(SettingInfo.class);
String siteURL = si.getSiteUrl() + context.getBaseUrl();
elUser.getSecurity().setPassword(PasswordUtil.encode(context, password));
userRepository.save(elUser);
// generate email details using customisable stylesheet
//TODO: allow internationalised emails
Element root = new Element("root");
root.addContent(elUser.asXml());
root.addContent(new Element("site").setText(thisSite));
root.addContent(new Element("siteURL").setText(siteURL));
root.addContent(new Element("adminEmail").setText(adminEmail));
root.addContent(new Element("password").setText(password));