[TASK] Add feUserPasswordHash to ChangePassword DTO

In order to make the ChangePasswordValidator
independent from a current fe_user session,
the password hash for the checkEqualsOldPassword
comparison is moved to the ChangePassword DTO

Refs #50

Author: derhansen

Classes/Controller/PasswordController.php

@@ -19,6 +19,7 @@
 use TYPO3\CMS\Extbase\Mvc\Controller\ActionController;
 use TYPO3\CMS\Extbase\Security\Exception\InvalidHashException;
 use TYPO3\CMS\Extbase\Utility\LocalizationUtility;
+use TYPO3\CMS\Frontend\Authentication\FrontendUserAuthentication;
 
 /**
  * Class PasswordController
@@ -69,6 +70,7 @@ public function initializeUpdateAction()
                 1572672118931
             );
         }
+        $this->setFeUserPasswordHashToArguments($changePasswordArray);
     }
 
     /**
@@ -96,6 +98,24 @@ public function updateAction(ChangePassword $changePassword): ResponseInterface
         return $this->htmlResponse();
     }
 
+    /**
+     * Sets the current fe_user password (hashed) to request argument "changePassword"
+     *
+     * @param array $changePasswordArray
+     * @throws \TYPO3\CMS\Extbase\Mvc\Exception\NoSuchArgumentException
+     */
+    protected function setFeUserPasswordHashToArguments(array $changePasswordArray): void
+    {
+        $changePasswordArgument = $this->arguments->getArgument('changePassword');
+        $propertyMapping = $changePasswordArgument->getPropertyMappingConfiguration();
+        $propertyMapping->allowProperties('feUserPasswordHash');
+
+        $changePasswordArray['feUserPasswordHash'] = $this->getFrontendUser()->user['password'];
+        $arguments = $this->request->getArguments();
+        $arguments['changePassword'] = $changePasswordArray;
+        $this->request->setArguments($arguments);
+    }
+
     /**
      * Suppress default flash messages
      *
@@ -105,4 +125,9 @@ protected function getErrorFlashMessage(): bool
     {
         return false;
     }
+
+    protected function getFrontendUser(): FrontendUserAuthentication
+    {
+        return $GLOBALS['TSFE']->fe_user;
+    }
 }

Classes/Domain/Model/Dto/ChangePassword.php

@@ -19,6 +19,7 @@ class ChangePassword
     protected string $password1 = '';
     protected string $password2 = '';
     protected string $currentPassword = '';
+    protected string $feUserPasswordHash = '';
     protected string $changeHmac = '';
     protected bool $skipCurrentPasswordCheck = false;
 
@@ -71,4 +72,14 @@ public function setSkipCurrentPasswordCheck(bool $skipCurrentPasswordCheck): voi
     {
         $this->skipCurrentPasswordCheck = $skipCurrentPasswordCheck;
     }
+
+    public function getFeUserPasswordHash(): string
+    {
+        return $this->feUserPasswordHash;
+    }
+
+    public function setFeUserPasswordHash(string $feUserPasswordHash): void
+    {
+        $this->feUserPasswordHash = $feUserPasswordHash;
+    }
 }

Classes/Service/OldPasswordService.php

@@ -11,6 +11,7 @@
 
 namespace Derhansen\FeChangePwd\Service;
 
+use Derhansen\FeChangePwd\Domain\Model\Dto\ChangePassword;
 use Derhansen\FeChangePwd\Exception\MissingPasswordHashServiceException;
 use TYPO3\CMS\Core\Crypto\PasswordHashing\PasswordHashFactory;
 use TYPO3\CMS\Core\Utility\GeneralUtility;
@@ -22,18 +23,18 @@
 class OldPasswordService
 {
     /**
-     * Returns if the given password equals the old password
+     * Returns if the password in $changePassword equals the old password by using the given current password hash
      *
-     * @param string $password
+     * @param ChangePassword $changePassword
      * @return bool
      * @throws MissingPasswordHashServiceException
      * @throws \TYPO3\CMS\Core\Crypto\PasswordHashing\InvalidPasswordHashException
      */
-    public function checkEqualsOldPassword(string $password): bool
+    public function checkEqualsOldPassword(ChangePassword $changePassword): bool
     {
         if (class_exists(PasswordHashFactory::class)) {
             $hashInstance = GeneralUtility::makeInstance(PasswordHashFactory::class)->getDefaultHashInstance('FE');
-            $equals = $hashInstance->checkPassword($password, $this->getFrontendUser()->user['password']);
+            $equals = $hashInstance->checkPassword($changePassword->getPassword1(), $changePassword->getFeUserPasswordHash());
         } else {
             throw new MissingPasswordHashServiceException(
                 'No secure password hashing service could be initialized. Please check your TYPO3 system configuration',

Classes/Validation/Validator/ChangePasswordValidator.php

@@ -178,7 +178,7 @@ protected function evaluatePwnedPasswordCheck(ChangePassword $changePassword)
      */
     protected function evaluateOldPasswordCheck(ChangePassword $changePassword)
     {
-        if ($this->oldPasswordService->checkEqualsOldPassword($changePassword->getPassword1())) {
+        if ($this->oldPasswordService->checkEqualsOldPassword($changePassword)) {
             $this->addError(
                 $this->localizationService->translate('oldPasswordFailure'),
                 1570880406
@@ -205,7 +205,7 @@ protected function evaluateRequireCurrentPassword(ChangePassword $changePassword
         }
 
         if ($oldPasswordEmpty === false &&
-            !$this->oldPasswordService->checkEqualsOldPassword($changePassword->getCurrentPassword())
+            !$this->oldPasswordService->checkEqualsOldPassword($changePassword)
         ) {
             $result = false;
             $this->addError(