Avoid Username/Email is passed as clear GET Parameter to CheckEmailAction on password reset process

src/Action/CheckEmailAction.php

@@ -15,32 +15,107 @@
 
 use Sonata\AdminBundle\Admin\Pool;
 use Sonata\AdminBundle\Templating\TemplateRegistryInterface;
-use Symfony\Component\HttpFoundation\RedirectResponse;
-use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
 use Twig\Environment;
+use TypeError;
 
 final class CheckEmailAction
 {
+
+    private Pool $adminPool;
+    private TemplateRegistryInterface $templateRegistry;
+    private int $tokenTtl;
+
+    /**
+     *  NEXT_MAJOR: Remove `$tokenTtlDeprecated` argument and only allow first types of arguments.
+     *
+     * @param Environment $twig
+     * @param Pool $adminPool
+     * @param TemplateRegistryInterface $templateRegistry
+     * @param int $tokenTtl
+     * @param null $tokenTtlDeprecated
+     */
     public function __construct(
         private Environment $twig,
-        private UrlGeneratorInterface $urlGenerator,
-        private Pool $adminPool,
-        private TemplateRegistryInterface $templateRegistry,
-        private int $tokenTtl
+        Pool|UrlGeneratorInterface $adminPool,
+        TemplateRegistryInterface|Pool $templateRegistry,
+        int|TemplateRegistryInterface $tokenTtl,
+        ?int $tokenTtlDeprecated = null,
     ) {
-    }
+        // NEXT_MAJOR: Remove all checks and use constructor property promotion instead
+        if ($adminPool instanceof UrlGeneratorInterface) {
+            if (!$templateRegistry instanceof Pool) {
+                throw new \TypeError(sprintf(
+                    'Argument 3 passed to %s() must be an instance of %s, %s given.',
+                    __METHOD__,
+                    Pool::class,
+                    \get_class($templateRegistry)
+                ));
+            }
+            $this->adminPool = $templateRegistry;
 
-    public function __invoke(Request $request): Response
-    {
-        $username = $request->query->get('username');
+            if (!$tokenTtl instanceof TemplateRegistryInterface) {
+                throw new \TypeError(sprintf(
+                    'Argument 4 passed to %s() must be an instance of %s, %s given.',
+                    __METHOD__,
+                    TemplateRegistryInterface::class,
+                    \get_class($tokenTtl)
+                ));
+            }
+            $this->templateRegistry = $tokenTtl;
+
+            if (!is_int($tokenTtlDeprecated)) {
+                throw new \TypeError(sprintf(
+                    'Argument 5 passed to %s() must be type of %s, %s given.',
+                    __METHOD__,
+                    'integer',
+                    \gettype($tokenTtlDeprecated)
+                ));
+            }
+            $this->tokenTtl = $tokenTtlDeprecated;
 
-        if (null === $username) {
-            // the user does not come from the sendEmail action
-            return new RedirectResponse($this->urlGenerator->generate('sonata_user_admin_resetting_request'));
+            @trigger_error(sprintf(
+                'Passing an instance of %s as argument 2 to "%s()" is deprecated since sonata-project/user-bundle 5.x and will only accept an instance of %s in version 6.0.',
+                UrlGeneratorInterface::class,
+                __METHOD__,
+                Pool::class
+            ), \E_USER_DEPRECATED);
+        } else {
+            $this->adminPool = $adminPool;
+            if (!$templateRegistry instanceof TemplateRegistryInterface) {
+                throw new \TypeError(sprintf(
+                    'Argument 3 passed to %s() must be an instance of %s, %s given.',
+                    __METHOD__,
+                    TemplateRegistryInterface::class,
+                    \get_class($templateRegistry)
+                ));
+            }
+            $this->templateRegistry = $templateRegistry;
+
+            if (!is_int($tokenTtl)) {
+                throw new \TypeError(sprintf(
+                    'Argument 4 passed to %s() must be type of %s, %s given.',
+                    __METHOD__,
+                    'integer',
+                    \gettype($tokenTtl)
+                ));
+            }
+            $this->tokenTtl = $tokenTtl;
+
+            if (null !== $tokenTtlDeprecated) {
+                throw new \TypeError(sprintf(
+                    'Argument 5 passed to %s() must be %s, %s given.',
+                    __METHOD__,
+                    'NULL',
+                    \gettype($tokenTtlDeprecated)
+                ));
+            }
         }
+    }
 
+    public function __invoke(): Response
+    {
         return new Response($this->twig->render('@SonataUser/Admin/Security/Resetting/checkEmail.html.twig', [
             'base_template' => $this->templateRegistry->getTemplate('layout'),
             'admin_pool' => $this->adminPool,

src/Action/RequestAction.php

@@ -66,9 +66,7 @@ public function __invoke(Request $request): Response
                 $this->userManager->save($user);
             }
 
-            return new RedirectResponse($this->urlGenerator->generate('sonata_user_admin_resetting_check_email', [
-                'username' => $username,
-            ]));
+            return new RedirectResponse($this->urlGenerator->generate('sonata_user_admin_resetting_check_email'));
         }
 
         return new Response($this->twig->render('@SonataUser/Admin/Security/Resetting/request.html.twig', [

src/DependencyInjection/SonataUserExtension.php

@@ -121,7 +121,7 @@ private function configureResetting(array $config, ContainerBuilder $container):
             ->replaceArgument(9, $config['retry_ttl']);
 
         $container->getDefinition('sonata.user.action.check_email')
-            ->replaceArgument(4, $config['token_ttl']);
+            ->replaceArgument(3, $config['token_ttl']);
 
         $container->getDefinition('sonata.user.action.reset')
             ->replaceArgument(8, $config['token_ttl']);

src/Resources/config/actions_resetting.php

@@ -39,7 +39,6 @@
         ->public()
         ->args([
             service('twig'),
-            service('router'),
             service('sonata.admin.pool'),
             service('sonata.admin.global_template_registry'),
             abstract_arg('token ttl'),