Ensure spammers cannot be re-enabled by accident

Author: Seldaek

src/Controller/ResetPasswordController.php

@@ -97,9 +97,7 @@ public function reset(Request $request, UserPasswordHasherInterface $passwordHas
 
         if ($form->isSubmitted() && $form->isValid()) {
             $user->resetPasswordRequest();
-            if (!$user->hasRole('ROLE_SPAMMER')) {
-                $user->setEnabled(true);
-            }
+            $user->setEnabled(true);
 
             // Encode the plain password, and set it.
             $encodedPassword = $passwordHasher->hashPassword(

src/Entity/User.php

@@ -465,6 +465,10 @@ public function setEmailCanonical(string $emailCanonical): void
 
     public function setEnabled(bool $boolean): void
     {
+        if ($this->hasRole('ROLE_SPAMMER')) {
+            $boolean = false;
+        }
+
         $this->enabled = $boolean;
     }
 

src/Security/EmailVerifier.php

@@ -66,10 +66,7 @@ public function handleEmailConfirmation(Request $request, UserInterface $user):
         }
 
         $this->verifyEmailHelper->validateEmailConfirmationFromRequest($request, (string) $user->getId(), $user->getEmail());
-
-        if (!$user->hasRole('ROLE_SPAMMER')) {
-            $user->setEnabled(true);
-        }
+        $user->setEnabled(true);
 
         $this->getEM()->persist($user);
         $this->getEM()->flush();