重置用户密码时尝试获取非对象的属性

Question

I am trying to reset the password but I am getting the error message "Trying to get property of non-object". I have also attached the screen shot of my error please have a look at it.

My Controller for resetting the password:

class ResetPasswordController extends Controller
{
protected $user;

public function __construct(User $user)
{
    $this->user = $user;
}
public function showResetForm(Request $request, $token = null)
{
    return view('auth.passwords.reset')->with(
        ['token' => $token, 'email' => $request->email]
    );
}

public function reset(Request $request)
{
    try {
        $password = $this->user->where('id', Auth::user()->id)->value('password');

        if(Hash::check($request->input('current_password'),$password)) {

            $this->user->where('id', Auth::user()->id)->update(['password' => bcrypt($request->input('new_password'))]);

            $token = $request->header('Authorization');

            JWT::invalidate($token);

            Auth::logout();

            return response(['status' => true, 'message' => 'Password changed successfully'], 200);

        } else {
            return response(['status' => false, 'message' => 'The Current Password is invalid.'], 200);
        }
    } catch (\Exception $ex) {
        return response(['status' => false, 'message' => $ex->getMessage()], 500);
    }
}

}

My Routes configuration:

   \Illuminate\Support\Facades\Auth::routes();

   Route::get('password/reset/{token}', 'Auth\ResetPasswordController@showResetForm');
   Route::post('password/reset', 'Auth\ResetPasswordController@reset')->name('password.request');

My View template:

        <form action="{{ route('password.request') }}" method="post">
<input type="hidden" name="_token" value="{{ csrf_token() }}">

<div class="form-group">
    <label for="login-form-email">Current Password</label>
    <input type="password" class="form-control" name="current_password" id="login-form-password" tabindex="2" placeholder="Current Password" tabindex="4">
</div>

<div class="form-group">
    <label for="login-form-password">New password</label>
    <input type="password" class="form-control" name="new_password" id="login-form-password" tabindex="2" placeholder="New Password" tabindex="4">
</div><!-- /.form-group -->

<div class="form-group">
    <label for="login-form-password-retype">Confirm new password</label>
    <input type="password" class="form-control" name="new_password_confirmation" id="login-form-password-retype" tabindex="3" placeholder="Confirm password">
</div><!-- /.form-group -->

<div class="form-group">
    <input type="submit"  class="btn btn-primary pull-right" name="reset-confirm" id="reset-confirm" tabindex="4" value="Reset Password">
</div>

Does anyone have a solution based on this code and error message? Your help will be highly appreciated!

Answer 1

User doesn't need to be a member

Your first problem is here:

public function __construct(User $user)

You're injecting a user, without it knowing what user to use, unless this is coming from middleware. So the constructor shouldn't take a user, nor do you need to protected member. If you really want it as a protected member you could do the following:

public function __construct()
{
    $this->user = Auth::user();
}

But since you have Auth::user(), you don't need it as a member.

where on a Model is Static

You have

$this->user->where('id', Auth::user()->id)->value('password')

Model's where function is a static function you shouldn't call it on an individual object. Instead you shoud call it using the scoping operator (::). Most versions of PHP should error out at that point. The correct way to get the current user's password hash from the database is:

$hash = Auth::user()->password;

If you had an id, you could:

$hash = User::where('id','=',$userId)->get()->password;

If you kept the user as a member (against the recommendation) but did it as in the above section of this answer, you could:

$hash = $this->user->password

Why?

Lastly, the Auth module from Laravel in modern versions already takes care of this for you in app\Http\Controllers\Auth. Why are reinventing the wheel?