PrivacyController
extends AuthenticatedController
in package
PrivacyController - User Privacy Settings Management
Handles user privacy settings including email and password modifications. Implements security measures such as:
- Password verification and email code verification for email changes
- 6-digit verification code for password changes
- Account blocking after multiple failed attempts
- Security alert emails for suspicious activity
Tags
Table of Contents
Properties
- $app : Application
- $auth : AuthManager
- $csrf : CsrfProtection
- $request : Request
- $response : Response
- $session : SessionManager
- $mailer : Mailer
- Mailer instance for sending emails
- $privacyManager : PrivacyManager
- Privacy manager instance for security operations
- $userManager : UserManager
- User manager instance for database operations
Methods
- __construct() : void
- Constructor - Route to appropriate action based on request
- getCsrfTokenForJs() : string
- Get the CSRF token for JavaScript usage
- redirect() : never
- Redirect to a URL
- redirectWithError() : never
- Redirect with an error message
- redirectWithSuccess() : never
- Redirect with a success message
- render() : void
- Render a view with automatic variable injection
- setError() : void
- Set an error flash message
- setFlash() : void
- Set a flash message
- setInfo() : void
- Set an info flash message
- setSuccess() : void
- Set a success flash message
- setWarning() : void
- Set a warning flash message
- validateCsrf() : bool
- Validate the CSRF token from the request
- handleMaxAttemptsReached() : void
- Handle max failed attempts reached
- requestEmailCode() : void
- Request email change - Step 1: Verify password and send code to new email
- requestPasswordCode() : void
- Request password change verification code
- resendEmailCode() : void
- Resend email verification code
- resendPasswordCode() : void
- Resend password change verification code
- showPrivacyPage() : void
- Display the privacy settings page
- verifyEmailCode() : void
- Verify email code and update email
- verifyPasswordCode() : void
- Verify password change code and update password
Properties
$app
protected
Application
$app
$auth
protected
AuthManager
$auth
$csrf
protected
CsrfProtection
$csrf
$request
protected
Request
$request
$response
protected
Response
$response
$session
protected
SessionManager
$session
$mailer
Mailer instance for sending emails
private
Mailer
$mailer
$privacyManager
Privacy manager instance for security operations
private
PrivacyManager
$privacyManager
$userManager
User manager instance for database operations
private
UserManager
$userManager
Methods
__construct()
Constructor - Route to appropriate action based on request
public
__construct() : void
Handles different privacy actions:
- requestEmailCode: Send verification code to new email
- resendEmailCode: Resend email verification code
- verifyEmailCode: Verify code and change email
- requestPasswordCode: Send verification code for password change
- resendPasswordCode: Resend verification code
- verifyPasswordCode: Verify code and change password
- default: Display privacy page
Tags
getCsrfTokenForJs()
Get the CSRF token for JavaScript usage
protected
getCsrfTokenForJs() : string
This method is useful for embedding the token in JavaScript or as a meta tag for automatic AJAX injection.
Return values
string —The current CSRF token
redirect()
Redirect to a URL
protected
redirect(string $url) : never
Parameters
- $url : string
-
Destination URL
Return values
never —Terminates execution
redirectWithError()
Redirect with an error message
protected
redirectWithError(string $url, string $message) : never
Parameters
- $url : string
-
Destination URL
- $message : string
-
Error message
Return values
never —Terminates execution
redirectWithSuccess()
Redirect with a success message
protected
redirectWithSuccess(string $url, string $message) : never
Parameters
- $url : string
-
Destination URL
- $message : string
-
Success message
Return values
never —Terminates execution
render()
Render a view with automatic variable injection
protected
render(string $viewPath[, array<string, mixed> $data = [] ]) : void
This method automatically injects services and data that all views need, eliminating the need to directly access $_SESSION or global functions.
Automatically injected variables:
- $csrf: CsrfProtection service
- $auth: AuthManager service
- $request: Request object
- $flash: Flash messages array (success, error, warning, info)
- $user: Current user data (null if not logged in)
Parameters
- $viewPath : string
-
View path (e.g., 'users/loginPageView')
- $data : array<string, mixed> = []
-
View-specific data
setError()
Set an error flash message
protected
setError(string $message) : void
Parameters
- $message : string
-
Error message
setFlash()
Set a flash message
protected
setFlash(string $type, string $message) : void
Parameters
- $type : string
-
Message type (success, error, warning, info)
- $message : string
-
Message to display
setInfo()
Set an info flash message
protected
setInfo(string $message) : void
Parameters
- $message : string
-
Info message
setSuccess()
Set a success flash message
protected
setSuccess(string $message) : void
Parameters
- $message : string
-
Success message
setWarning()
Set a warning flash message
protected
setWarning(string $message) : void
Parameters
- $message : string
-
Warning message
validateCsrf()
Validate the CSRF token from the request
protected
validateCsrf([string|null $token = null ]) : bool
Supports both traditional POST body tokens and modern AJAX header tokens. Checks in order:
- Provided token parameter
- POST body 'csrf_token' field
- X-CSRF-Token HTTP header (for AJAX requests)
Parameters
- $token : string|null = null
-
Token to validate (if null, retrieves from POST or header)
Return values
bool —True if valid, false otherwise
handleMaxAttemptsReached()
Handle max failed attempts reached
private
handleMaxAttemptsReached(int $userId, string $alertType) : void
Blocks the user account, sends security alert email, and logs out the user.
Parameters
- $userId : int
-
The user ID
- $alertType : string
-
Type of alert (email_change or password_change)
Return values
void —Redirects to login page
requestEmailCode()
Request email change - Step 1: Verify password and send code to new email
private
requestEmailCode() : void
Validates current password, checks email format and availability, then sends a verification code to the new email address.
Return values
void —Redirects to email verification form
requestPasswordCode()
Request password change verification code
private
requestPasswordCode() : void
Generates and sends a 6-digit verification code to the user's email.
Return values
void —Redirects to password verification form
resendEmailCode()
Resend email verification code
private
resendEmailCode() : void
Generates and sends a new verification code to the pending new email if cooldown has passed and max resends not reached.
Return values
void —Redirects to email verification form
resendPasswordCode()
Resend password change verification code
private
resendPasswordCode() : void
Generates and sends a new verification code if cooldown has passed and max resends not reached.
Return values
void —Redirects to password verification form
showPrivacyPage()
Display the privacy settings page
private
showPrivacyPage() : void
Shows the privacy page with email and password modification forms. Also displays resend status for codes.
verifyEmailCode()
Verify email code and update email
private
verifyEmailCode() : void
Validates the 6-digit code sent to the new email address, then updates the email. Blocks account after 10 failed attempts.
Return values
void —Redirects to privacy page with success or error message
verifyPasswordCode()
Verify password change code and update password
private
verifyPasswordCode() : void
Validates the 6-digit code and new password format, ensures new password is different from current, then updates the password. Blocks account after 10 failed attempts.
Return values
void —Redirects to privacy page with success or error message