ZF-Commons/ZfcUser — pull request #248 by tomphp (2013-02-23 22:38:08+00:00)
Title: Forgotten password

Forgotten Password
===============

Hi ZfcUser people,

I've had a bash at the Forgotten password feature. Here are some points about it.

Email
--------
This mechanism requires emails to be send and I have created 2 interfaces for doing this:

* `ZfcUser\Mail\MessageFetcherInterface` - this creates the body of the message from a template.
* `ZfcUser\Mail\MailTransportInterface` - the is for the actual sending.

I have provided a very basic implementation of these in `ZfcUser\Mail\ZendMail` which uses the standard Zend Framwork class for mail and renderering. Once ZfcMail or similar is ready it can easily be swapped out.

The version in this pull request only support Sendmail, I'll get Smtp done asap.

Also I've added a folder in the module root called `email` for email templates. I'm not sure if this is the best place?

Code & Design
----------------------
I did start writing the actions into `ZfcUser\Controller\UserController` but is was all getting a bit much so I've created a new controller called `ZfcUser\Controller\ForgottenPasswordController`. I hope this is ok but if there is a reason this module was trying to stick to a single controller it can be easily moved back into `UserController`.

There is a point where I talk to the mapper in the controller, is this something that should be hidden behind a service or is this ok?

Forms
---------
I'm assuming some CRSF & Captcha elements should be added but I'm not really sure of the current state of use of these in the module (most crsf stuff appears to be commented out).

Link Security
-------------------
The forgotten password system sends out an email with a link. I've included a hash (configurable) for security, this hash includes the user's password so once it is changed it will no longer be valid.

I'm sure a better approach would be to store a token or timestamp in the database and use that. I have not done this however as I didn't want to touch the database schema but again by implementing `ZfcUser\Hash\UserHashInterface` in a class which handles it more securely this would be possible.

Config
----------
There's a load more config options, mostly to do with the mail.

Comments & Docblocks
-----------------------------------
These seem to be a bit sparse in the ZfcUser code, have I over done it hehe?

Also no tests?

Hope this is something along the lines of what is required and I look forward to some feedback.