48 lines
1.5 KiB
PHP
48 lines
1.5 KiB
PHP
<?php
|
|
|
|
namespace App\Livewire\Auth;
|
|
|
|
use Illuminate\Support\Facades\Password;
|
|
use Livewire\Attributes\Layout;
|
|
use Livewire\Attributes\Validate;
|
|
use Livewire\Component;
|
|
|
|
/**
|
|
* "I cannot get in any more."
|
|
*
|
|
* There was no way out of that at all: Fortify's password-reset feature was
|
|
* switched off, so there was no link, no page and no route. A customer who
|
|
* forgot their password was locked out of their own cloud until somebody
|
|
* opened a shell — on a product whose selling point is that you can ring
|
|
* somebody, that is a support call a week and an embarrassing one.
|
|
*
|
|
* The answer is deliberately identical whether the address is known or not.
|
|
* "No account with that address" turns this form into a way of finding out who
|
|
* is a customer, which is the first thing anybody targeting a business does.
|
|
*/
|
|
#[Layout('layouts.portal')]
|
|
class ForgotPassword extends Component
|
|
{
|
|
#[Validate('required|email|max:255')]
|
|
public string $email = '';
|
|
|
|
public bool $sent = false;
|
|
|
|
public function send(): void
|
|
{
|
|
$this->validate();
|
|
|
|
// Throttled by Laravel's broker (once a minute per address). The
|
|
// response does not say which of the two happened: a slower answer for
|
|
// a known address would leak the same thing the message would.
|
|
Password::broker()->sendResetLink(['email' => $this->email]);
|
|
|
|
$this->sent = true;
|
|
}
|
|
|
|
public function render()
|
|
{
|
|
return view('livewire.auth.forgot-password');
|
|
}
|
|
}
|