[BUGFIX] Activate invited user on password submit instead of on form open

The invitation flow activated the invited fe_user (disable=0) already in
editAction - i.e. as soon as the invitee opened the password form via the
mail link. The account was therefore enabled even if the invitee never
finished setting a password.

Activation is now performed in updateAction, when the password is actually
submitted. editAction only renders the form.

Relates: https://projekte.in2code.de/issues/81311
Fixes in2code-pro/femanager#65, #633

Author: sebastianstein

Classes/Controller/InvitationController.php

@@ -141,10 +141,6 @@ public function editAction($user, $hash = null)
             $this->redirect('status');
         }
 
-        $user->setDisable(false);
-        $this->userRepository->update($user);
-        $this->persistenceManager->persistAll();
-
         $this->eventDispatcher->dispatch(new InviteUserEditEvent($user, $hash));
 
         $this->view->assignMultiple(
@@ -157,6 +153,21 @@ public function editAction($user, $hash = null)
         $this->assignForAll();
     }
 
+    /**
+     * The invited user is still disabled (disable=1) at this point. Extbase's typed-argument
+     * mapping respects enableFields and would not find it. Pre-loading it through the repository
+     * (which ignores enableFields) registers it in the persistence session, so the typed
+     * "user" argument is resolved from there instead of a fresh, enableFields-restricted query.
+     */
+    public function initializeUpdateAction()
+    {
+        $submitted = $this->request->hasArgument('user') ? $this->request->getArgument('user') : null;
+        $userUid = (int)(is_array($submitted) ? ($submitted['__identity'] ?? 0) : 0);
+        if ($userUid > 0) {
+            $this->userRepository->findByUid($userUid);
+        }
+    }
+
     /**
      * action update
      *
@@ -195,6 +206,7 @@ public function updateAction($user, $hash = null)
         }
         $user = UserUtility::overrideUserGroup($user, $this->settings, 'invitation');
         UserUtility::hashPassword($user, $this->settings['invitation']['misc']['passwordSave']);
+        $user->setDisable(false);
         $this->userRepository->update($user);
         $this->persistenceManager->persistAll();
         $this->eventDispatcher->dispatch(new InviteUserUpdateEvent($user));

Resources/Private/Language/locallang.xlf

@@ -421,7 +421,7 @@
 				<source>Your new profile was just created.</source>
 			</trans-unit>
 			<trans-unit id="emailInvitationText2">
-				<source>Please confirm your profile registration on our server by clicking the following link. After that, you can define a password.</source>
+				<source>Please confirm your profile registration on our server by clicking the following link. After that, you can define a password and activate your profile.</source>
 			</trans-unit>
 			<trans-unit id="emailInvitationLinkConfirm">
 				<source>Confirm Profile</source>
@@ -474,6 +474,9 @@
 			<trans-unit id="submitNew">
 				<source>Create Profile Now</source>
 			</trans-unit>
+			<trans-unit id="submitActivate">
+				<source>Activate Profile</source>
+			</trans-unit>
 			<trans-unit id="submitResend">
 				<source>Resend now</source>
 			</trans-unit>

Resources/Private/Partials/Fields/SubmitActivate.html

@@ -0,0 +1,8 @@
+<div class="femanager_fieldset femanager_submit form-group">
+	<div class="col-sm-10 col-sm-offset-2">
+		<f:form.submit
+				value="{f:translate(key:'submitActivate')}"
+				id="femanager_field_submit"
+				class="btn btn-primary btn-large" />
+	</div>
+</div>

Resources/Private/Templates/Invitation/Edit.html

@@ -28,7 +28,7 @@
 
 					<f:render partial="Fields/Password" arguments="{_all}" />
 
-					<f:render partial="Fields/SubmitUpdate" arguments="{_all}" />
+					<f:render partial="Fields/SubmitActivate" arguments="{_all}" />
 				</fieldset>
 			</f:form>
 		</f:if>