Issue #3055807 by ptmkenny, murilohp, vladimir.krupin, smustgrave,...

Issue #3055807 by ptmkenny, murilohp, vladimir.krupin, smustgrave, ankithashetty, yogeshmpawar, ravi.shankar, rensingh99, vikashsoni, axel80, alexpott: User created via /user/register?_format=json get blocked

core/modules/user/src/Plugin/rest/resource/UserRegistrationResource.php

@@ -3,6 +3,7 @@
 namespace Drupal\user\Plugin\rest\resource;
 
 use Drupal\Core\Config\ImmutableConfig;
+use Drupal\Core\Password\PasswordGeneratorInterface;
 use Drupal\Core\Session\AccountInterface;
 use Drupal\Core\StringTranslation\TranslatableMarkup;
 use Drupal\rest\Attribute\RestResource;
@@ -34,20 +35,6 @@ class UserRegistrationResource extends ResourceBase {
   use EntityResourceValidationTrait;
   use EntityResourceAccessTrait;
 
-  /**
-   * User settings config instance.
-   *
-   * @var \Drupal\Core\Config\ImmutableConfig
-   */
-  protected $userSettings;
-
-  /**
-   * The current user.
-   *
-   * @var \Drupal\Core\Session\AccountInterface
-   */
-  protected $currentUser;
-
   /**
    * Constructs a new UserRegistrationResource instance.
    *
@@ -61,15 +48,24 @@ class UserRegistrationResource extends ResourceBase {
    *   The available serialization formats.
    * @param \Psr\Log\LoggerInterface $logger
    *   A logger instance.
-   * @param \Drupal\Core\Config\ImmutableConfig $user_settings
+   * @param \Drupal\Core\Config\ImmutableConfig $userSettings
    *   A user settings config instance.
-   * @param \Drupal\Core\Session\AccountInterface $current_user
+   * @param \Drupal\Core\Session\AccountInterface $currentUser
    *   The current user.
+   * @param \Drupal\Core\Password\PasswordGeneratorInterface $passwordGenerator
+   *   The password generator.
    */
-  public function __construct(array $configuration, $plugin_id, $plugin_definition, array $serializer_formats, LoggerInterface $logger, ImmutableConfig $user_settings, AccountInterface $current_user) {
+  public function __construct(
+    array $configuration,
+    $plugin_id,
+    $plugin_definition,
+    array $serializer_formats,
+    LoggerInterface $logger,
+    protected ImmutableConfig $userSettings,
+    protected AccountInterface $currentUser,
+    protected PasswordGeneratorInterface $passwordGenerator,
+  ) {
     parent::__construct($configuration, $plugin_id, $plugin_definition, $serializer_formats, $logger);
-    $this->userSettings = $user_settings;
-    $this->currentUser = $current_user;
   }
 
   /**
@@ -83,7 +79,8 @@ public static function create(ContainerInterface $container, array $configuratio
       $container->getParameter('serializer.formats'),
       $container->get('logger.factory')->get('rest'),
       $container->get('config.factory')->get('user.settings'),
-      $container->get('current_user')
+      $container->get('current_user'),
+      $container->get('password_generator')
     );
   }
 
@@ -102,15 +99,19 @@ public static function create(ContainerInterface $container, array $configuratio
   public function post(UserInterface $account = NULL) {
     $this->ensureAccountCanRegister($account);
 
-    // Only activate new users if visitors are allowed to register and no email
-    // verification required.
-    if ($this->userSettings->get('register') == UserInterface::REGISTER_VISITORS && !$this->userSettings->get('verify_mail')) {
+    // Only activate new users if visitors are allowed to register.
+    if ($this->userSettings->get('register') == UserInterface::REGISTER_VISITORS) {
       $account->activate();
     }
     else {
       $account->block();
     }
 
+    // Generate password if email verification required.
+    if ($this->userSettings->get('verify_mail')) {
+      $account->setPassword($this->passwordGenerator->generate());
+    }
+
     $this->checkEditFieldAccess($account);
 
     // Make sure that the user entity is valid (email and name are valid).

core/modules/user/tests/src/Functional/UserRegistrationRestTest.php

@@ -103,8 +103,8 @@ public function testRegisterUser() {
     $config->save();
     $name = 'Jason.Taverner';
     $user = $this->registerUser($name, FALSE);
-    $this->assertEmpty($user->getPassword());
-    $this->assertTrue($user->isBlocked());
+    $this->assertNotEmpty($user->getPassword());
+    $this->assertFalse($user->isBlocked());
     $this->resetAll();
 
     $this->assertMailString('body', 'You may now log in by clicking this link', 1);
@@ -128,7 +128,7 @@ public function testRegisterUser() {
     $name = 'PhilipK.Dick';
     $user = $this->registerUser($name, FALSE);
     $this->resetAll();
-    $this->assertEmpty($user->getPassword());
+    $this->assertNotEmpty($user->getPassword());
     $this->assertTrue($user->isBlocked());
 
     $this->assertMailString('body', 'Your application for an account is', 2);

core/modules/user/tests/src/Unit/UserRegistrationResourceTest.php

@@ -5,6 +5,7 @@
 namespace Drupal\Tests\user\Unit;
 
 use Drupal\Core\Config\ImmutableConfig;
+use Drupal\Core\Password\PasswordGeneratorInterface;
 use Drupal\Core\Session\AccountInterface;
 use Drupal\Tests\UnitTestCase;
 use Drupal\user\Entity\User;
@@ -59,6 +60,13 @@ class UserRegistrationResourceTest extends UnitTestCase {
    */
   protected $currentUser;
 
+  /**
+   * The password generator.
+   *
+   * @var \Drupal\Core\Password\PasswordGeneratorInterface|\PHPUnit\Framework\MockObject\MockObject
+   */
+  protected $passwordGenerator;
+
   /**
    * {@inheritdoc}
    */
@@ -71,7 +79,9 @@ protected function setUp(): void {
 
     $this->currentUser = $this->prophesize(AccountInterface::class);
 
-    $this->testClass = new UserRegistrationResource([], 'plugin_id', '', [], $this->logger, $this->userSettings->reveal(), $this->currentUser->reveal());
+    $this->passwordGenerator = $this->prophesize(PasswordGeneratorInterface::class)->reveal();
+
+    $this->testClass = new UserRegistrationResource([], 'plugin_id', '', [], $this->logger, $this->userSettings->reveal(), $this->currentUser->reveal(), $this->passwordGenerator);
     $this->reflection = new \ReflectionClass($this->testClass);
   }
 
@@ -103,7 +113,7 @@ public function testRegistrationAdminOnlyPost() {
 
     $this->currentUser->isAnonymous()->willReturn(TRUE);
 
-    $this->testClass = new UserRegistrationResource([], 'plugin_id', '', [], $this->logger, $this->userSettings->reveal(), $this->currentUser->reveal());
+    $this->testClass = new UserRegistrationResource([], 'plugin_id', '', [], $this->logger, $this->userSettings->reveal(), $this->currentUser->reveal(), $this->passwordGenerator);
 
     $entity = $this->prophesize(User::class);
     $entity->isNew()->willReturn(TRUE);
@@ -119,7 +129,7 @@ public function testRegistrationAdminOnlyPost() {
   public function testRegistrationAnonymousOnlyPost() {
     $this->currentUser->isAnonymous()->willReturn(FALSE);
 
-    $this->testClass = new UserRegistrationResource([], 'plugin_id', '', [], $this->logger, $this->userSettings->reveal(), $this->currentUser->reveal());
+    $this->testClass = new UserRegistrationResource([], 'plugin_id', '', [], $this->logger, $this->userSettings->reveal(), $this->currentUser->reveal(), $this->passwordGenerator);
 
     $entity = $this->prophesize(User::class);
     $entity->isNew()->willReturn(TRUE);