CoolCMS API

SendActivationEmailTrait

Public action "resend the activation e-mail" (grant `guest`), shared by `UserPresenter` and `AuthPresenter` so that the gate cannot be bypassed through the other address.

Without a limit every call for an inactive account would send another e-mail, and a response that differed for a nonexistent / already active / inactive account would be an oracle. Rules (pattern UserPresenter::internalActionSendNewPassword()):

  • The limit is evaluated before the manager (after it the e-mail is already queued).
  • Two dimensions, per IP and per account (hash of the normalized username, no personal data in the key); both count even for a nonexistent account, so the limit itself does not reveal existence.
  • The response is a constant success for every branch (nonexistent / active / throttled / delivery failure); the difference goes only to the auth log.

The host must have $userManager, $rateLimit and $rateLimitConfig.

Table of Contents

Methods

activationUserKey()  : string
passesSendActivationEmailRateLimit()  : bool
sendActivationEmailOperation()  : array<string, mixed>

Methods

activationUserKey()

private static activationUserKey(string $username) : string
Parameters
$username : string
Return values
string

passesSendActivationEmailRateLimit()

private passesSendActivationEmailRateLimit(string $username) : bool
Parameters
$username : string
Return values
bool

sendActivationEmailOperation()

private sendActivationEmailOperation(string $username) : array<string, mixed>
Parameters
$username : string
Return values
array<string, mixed>
On this page

Search results