Overriding a Statamic method

[christie-hill-za]

Hello, I have been asked by management to add password history functionality for up to 5 password hashes to our Statamic (4.460) CMS and it seems I must override the way Statamic saves a user's password to include storing a hash of it in my password_histories table.

I already created a custom validation rule for checking on this table, and a PasswordHistory model, table and all of the bells and whistles it needs to function.

I tried overriding the PasswordController using two methods: one is via binding in the AppServiceProvider.php file and another by adding an "exclude-from-classmap" array with the class to exclude, and include my override file.

I tried both of these methods and none seem to register my overrides. I'm not even sure if this is the correct way of doing it. I've been reading up on overriding vendor classes for two days and trying everything suggested, but none of the methods load my custom PasswordController file. (I don't really want to be overriding Statamic's files, to be honest, but management has requested this for cybersecurity insurance).

What am I doing wrong, and if there's a better way, how should I achieve storing a hash of a user's last 5 passwords in a database table?

[christie-hill-za]

Oh dear, how embarrassing, I forgot to add the original file's namespace declaration at the top of my overriding controller!

For similar queries in the future, I got it working with creating an overrides directory in the root application folder, created a PasswordController.php file in there and pasted the original file contents of vendor/statamic/Http/Controllers/CP/Users/PasswordController.php and added a couple of lines of code to create an entry in the password_histories table.

Then, in composer.json, adjust your "autoload" array key to something similar:

"autoload": {
        "exclude-from-classmap": [
            "/vendor/statamic/cms/src/Http/Controllers/CP/Users/PasswordController.php"
        ],
        "psr-4": {
            ... some stuff here that I didn't touch
        },
        "files": [
            "overrides/PasswordController.php"
        ]
    },

[duncanmcclean]

Usually, trying to override methods provided by a package (like Statamic) is considered bad practice.

What are you trying to add/remove/change about Statamic's PasswordController?

[christie-hill-za]

Yeah I know it's terrible practice, I am so sorry! I really hate doing this, to be honest...

Why I have to do this is because I have been asked by Management to add password history functionality and prevent people from using the same password in the last 5 password changes.

Like I mentioned in my question, I don't want to be overriding Statamic's methods, it's bad practice, but business requires it for cybersecurity insurance, unfortunately.

I've already added a custom validation rule for passwords and used some of Laravel's built-in methods (which are great) such as minimum, mixed case, numbers, etc.

It's also not a great user experience, but I can't really do much about this.

[duncanmcclean]

Laravel doesn't seem to document it very well but you can hook into the default password validation rules: laravel/framework#37387

For example:

use Illuminate\Validation\Rules\Password;

Password::defaultUsing(function() {
     return Password::min(8)->uncompromised();
});