ForceAdminPasswordChangeObserver.php

Go to the documentation of this file.

<?php
namespace Magento\User\Observer\Backend;

use Magento\Framework\Event\Observer as EventObserver;
use Magento\Framework\Event\ObserverInterface;

class ForceAdminPasswordChangeObserver implements ObserverInterface
{
    protected $observerConfig;

    protected $authorization;

    protected $url;

    protected $session;

    protected $authSession;

    protected $actionFlag;

    protected $messageManager;

    public function __construct(
        \Magento\Framework\AuthorizationInterface $authorization,
        \Magento\User\Model\Backend\Config\ObserverConfig $observerConfig,
        \Magento\Backend\Model\UrlInterface $url,
        \Magento\Backend\Model\Session $session,
        \Magento\Backend\Model\Auth\Session $authSession,
        \Magento\Framework\App\ActionFlag $actionFlag,
        \Magento\Framework\Message\ManagerInterface $messageManager
    ) {
        $this->authorization = $authorization;
        $this->observerConfig = $observerConfig;
        $this->url = $url;
        $this->session = $session;
        $this->authSession = $authSession;
        $this->actionFlag = $actionFlag;
        $this->messageManager = $messageManager;
    }

    public function execute(EventObserver $observer)
    {
        if (!$this->observerConfig->isPasswordChangeForced()) {
            return;
        }
        if (!$this->authSession->isLoggedIn()) {
            return;
        }
        $actionList = [
            'adminhtml_system_account_index',
            'adminhtml_system_account_save',
            'adminhtml_auth_logout',
            'mui_index_render'
        ];
        $controller = $observer->getEvent()->getControllerAction();
        $request = $observer->getEvent()->getRequest();

        if ($this->authSession->getPciAdminUserIsPasswordExpired()) {
            if (!in_array($request->getFullActionName(), $actionList)) {
                if ($this->authorization->isAllowed('Magento_Backend::myaccount')) {
                    $controller->getResponse()->setRedirect($this->url->getUrl('adminhtml/system_account/'));
                    $this->actionFlag->set('', \Magento\Framework\App\Action\Action::FLAG_NO_DISPATCH, true);
                    $this->actionFlag->set('', \Magento\Framework\App\Action\Action::FLAG_NO_POST_DISPATCH, true);
                } else {
                    /*
                     * if admin password is expired and access to 'My Account' page is denied
                     * than we need to do force logout with error message
                     */
                    $this->authSession->clearStorage();
                    $this->session->clearStorage();
                    $this->messageManager->addErrorMessage(
                        __('Your password has expired; please contact your administrator.')
                    );
                    $controller->getRequest()->setDispatched(false);
                }
            }
        }
    }
}