5 * @subpackage SpecialPage
11 function wfSpecialUserlogin() {
12 global $wgCommandLineMode;
14 if( !$wgCommandLineMode && !isset( $_COOKIE[ini_get('session.name')] ) ) {
18 $form = new LoginForm( $wgRequest );
25 * @subpackage SpecialPage
28 var $mName, $mPassword, $mRetype, $mReturnto, $mCookieCheck, $mPosted;
29 var $mAction, $mCreateaccount, $mCreateaccountMail, $mMailmypassword;
30 var $mLoginattempt, $mRemember, $mEmail;
34 * @param webrequest $request A webrequest object passed by reference
36 function LoginForm( &$request ) {
37 global $wgLang, $wgAllowRealName, $wgEnableEmail;
39 $this->mName
= $request->getText( 'wpName' );
40 $this->mPassword
= $request->getText( 'wpPassword' );
41 $this->mRetype
= $request->getText( 'wpRetype' );
42 $this->mReturnto
= $request->getVal( 'returnto' );
43 $this->mCookieCheck
= $request->getVal( 'wpCookieCheck' );
44 $this->mPosted
= $request->wasPosted();
45 $this->mCreateaccount
= $request->getCheck( 'wpCreateaccount' );
46 $this->mCreateaccountMail
= $request->getCheck( 'wpCreateaccountMail' )
48 $this->mMailmypassword
= $request->getCheck( 'wpMailmypassword' )
50 $this->mLoginattempt
= $request->getCheck( 'wpLoginattempt' );
51 $this->mAction
= $request->getVal( 'action' );
52 $this->mRemember
= $request->getCheck( 'wpRemember' );
54 if( $wgEnableEmail ) {
55 $this->mEmail
= $request->getText( 'wpEmail' );
59 if( $wgAllowRealName ) {
60 $this->mRealName
= $request->getText( 'wpRealName' );
62 $this->mRealName
= '';
65 # When switching accounts, it sucks to get automatically logged out
66 if( $this->mReturnto
== $wgLang->specialPage( 'Userlogout' ) ) {
67 $this->mReturnto
= '';
72 if ( !is_null( $this->mCookieCheck
) ) {
73 $this->onCookieRedirectCheck( $this->mCookieCheck
);
75 } else if( $this->mPosted
) {
76 if( $this->mCreateaccount
) {
77 return $this->addNewAccount();
78 } else if ( $this->mCreateaccountMail
) {
79 return $this->addNewAccountMailPassword();
80 } else if ( $this->mMailmypassword
) {
81 return $this->mailPassword();
82 } else if ( ( 'submitlogin' == $this->mAction
) ||
$this->mLoginattempt
) {
83 return $this->processLogin();
86 $this->mainLoginForm( '' );
92 function addNewAccountMailPassword() {
94 global $wgEmailAuthentication;
96 if ('' == $this->mEmail
) {
97 $this->mainLoginForm( wfMsg( 'noemail', htmlspecialchars( $this->mName
) ) );
101 $u = $this->addNewaccountInternal();
107 $newadr = strtolower($this->mEmail
);
109 # prepare for authentication and mail a temporary password to newadr
110 if ( !$u->isValidEmailAddr( $newadr ) ) {
111 return $this->mainLoginForm( wfMsg( 'invalidemailaddress', $error ) );
113 $u->mEmail
= $newadr; # new behaviour: set this new emailaddr from login-page into user database record
114 $u->mEmailAuthenticationtimestamp
= 0; # but flag as "dirty" = unauthenticated
116 if ($wgEmailAuthentication) {
117 $error = $this->mailPasswordInternal( $u, true, $dummy ); # mail a temporary password to the dirty address
120 $wgOut->setPageTitle( wfMsg( 'accmailtitle' ) );
121 $wgOut->setRobotpolicy( 'noindex,nofollow' );
122 $wgOut->setArticleRelated( false );
124 if ($wgEmailAuthentication) {
126 return $this->mainLoginForm( wfMsg( 'passwordsentforemailauthentication', $u->getName() ) );
128 return $this->mainLoginForm( wfMsg( 'mailerror', $error ) );
130 # if user returns, that new email address gets authenticated in checkpassword()
132 # if ( $error === '' ) {
133 # $wgOut->addWikiText( wfMsg( 'accmailtext', $u->getName(), $u->getEmail() ) );
134 # $wgOut->returnToMain( false );
136 # $this->mainLoginForm( wfMsg( 'mailerror', $error ) );
145 function addNewAccount() {
146 global $wgUser, $wgOut;
147 global $wgEmailAuthentication;
149 $u = $this->addNewAccountInternal();
155 $newadr = strtolower($this->mEmail
);
156 if ($newadr != '') { # prepare for authentication and mail a temporary password to newadr
157 if ( !$u->isValidEmailAddr( $newadr ) ) {
158 return $this->mainLoginForm( wfMsg( 'invalidemailaddress', $error ) );
160 $u->mEmail
= $newadr; # new behaviour: set this new emailaddr from login-page into user database record
161 $u->mEmailAuthenticationtimestamp
= 0; # but flag as "dirty" = unauthenticated
163 if ($wgEmailAuthentication) {
164 # mail a temporary password to the dirty address
166 $error = $this->mailPasswordInternal( $u, true, $dummy );
168 return $this->mainLoginForm( wfMsg( 'passwordsentforemailauthentication', $u->getName() ) );
170 return $this->mainLoginForm( wfMsg( 'mailerror', $error ) );
172 # if user returns, that new email address gets authenticated in checkpassword()
177 $wgUser->setCookies();
179 $wgUser->saveSettings();
181 if( $this->hasSessionCookie() ) {
182 return $this->successfulLogin( wfMsg( 'welcomecreation', $wgUser->getName() ) );
184 return $this->cookieRedirectCheck( 'new' );
191 function addNewAccountInternal() {
192 global $wgUser, $wgOut;
193 global $wgMaxNameChars;
194 global $wgMemc, $wgAccountCreationThrottle, $wgDBname, $wgIP;
195 global $wgMinimalPasswordLength;
197 if (!$wgUser->isAllowedToCreateAccount()) {
198 $this->userNotPrivilegedMessage();
202 if ( 0 != strcmp( $this->mPassword
, $this->mRetype
) ) {
203 $this->mainLoginForm( wfMsg( 'badretype' ) );
207 $name = trim( $this->mName
);
208 $u = User
::newFromName( $name );
209 if ( is_null( $u ) ||
211 $wgUser->isIP( $name ) ||
212 (strpos( $name, '/' ) !== false) ||
213 (strlen( $name ) > $wgMaxNameChars) ||
214 ucFirst($name) != $u->getName() )
216 $this->mainLoginForm( wfMsg( 'noname' ) );
219 if ( wfReadOnly() ) {
220 $wgOut->readOnlyPage();
224 if ( 0 != $u->idForName() ) {
225 $this->mainLoginForm( wfMsg( 'userexists' ) );
229 if ( strlen( $this->mPassword
) < $wgMinimalPasswordLength ) {
230 $this->mainLoginForm( wfMsg( 'passwordtooshort', $wgMinimalPasswordLength ) );
234 if ( $wgAccountCreationThrottle ) {
235 $key = $wgDBname.':acctcreate:ip:'.$wgIP;
236 $value = $wgMemc->incr( $key );
238 $wgMemc->set( $key, 1, 86400 );
240 if ( $value > $wgAccountCreationThrottle ) {
241 $this->throttleHit( $wgAccountCreationThrottle );
246 return $this->initUser( $u );
250 * Actually add a user to the database.
251 * Give it a User object that has been initialised with a name.
257 function &initUser( &$u ) {
259 $u->setPassword( $this->mPassword
);
260 $u->setEmail( $this->mEmail
);
261 $u->setRealName( $this->mRealName
);
265 $wgAuth->initUser( $u );
267 if ( $this->mRemember
) { $r = 1; }
269 $u->setOption( 'rememberpassword', $r );
277 function processLogin() {
278 global $wgUser, $wgLang;
279 global $wgEmailAuthentication;
281 if ( '' == $this->mName
) {
282 $this->mainLoginForm( wfMsg( 'noname' ) );
285 $u = User
::newFromName( $this->mName
);
286 if( is_null( $u ) ) {
287 $this->mainLoginForm( wfMsg( 'noname' ) );
290 if ( 0 == $u->getID() ) {
293 * If the external authentication plugin allows it,
294 * automatically create a new account for users that
295 * are externally defined but have not yet logged in.
297 if ( $wgAuth->autoCreate() && $wgAuth->userExists( $u->getName() ) ) {
298 if ( $wgAuth->authenticate( $u->getName(), $this->mPassword
) ) {
299 $u =& $this->initUser( $u );
301 $this->mainLoginForm( wfMsg( 'wrongpassword' ) );
305 $this->mainLoginForm( wfMsg( 'nosuchuser', $u->getName() ) );
309 $u->loadFromDatabase();
312 # store temporarily the status before the password check is performed
314 $oldadr = strtolower($u->getEmail());
315 $newadr = strtolower($this->mEmail
);
316 $alreadyauthenticated = (( $u->mEmailAuthenticationtimestamp
!= 0 ) ||
($oldadr == '')) ;
318 # checkPassword sets EmailAuthenticationtimestamp, if the newPassword is used
320 if (!$u->checkPassword( $this->mPassword
)) {
321 $this->mainLoginForm( wfMsg( 'wrongpassword' ) );
325 # We've verified now, update the real record
327 if ( $this->mRemember
) {
332 $u->setOption( 'rememberpassword', $r );
334 /* check if user with correct password has entered a new email address */
335 if (($newadr <> '') && ($newadr <> $oldadr)) { # the user supplied a new email address on the login page
337 # prepare for authentication and mail a temporary password to newadr
338 if ( !$u->isValidEmailAddr( $newadr ) ) {
339 return $this->mainLoginForm( wfMsg( 'invalidemailaddress', $error ) );
341 $u->mEmail
= $newadr; # new behaviour: store this new emailaddr from login-page now into user database record ...
342 $u->mEmailAuthenticationtimestamp
= 0; # ... but flag the address as "dirty" (unauthenticated)
343 $alreadyauthenticated = false;
345 if ($wgEmailAuthentication) {
347 # mail a temporary one-time password to the dirty address and return here to complete the user login
348 # if the user returns now or later using this temp. password, then the new email address $newadr
349 # - which is already stored in his user record - gets authenticated in checkpassword()
351 $error = $this->mailPasswordInternal( $u, false, $newpassword_temp);
352 $u->mNewpassword
= $newpassword_temp;
354 # The temporary password is mailed. The user is logged-in as he entered his correct password
355 # This appears to be more intuitive than alternative 2.
358 $mailmsg = '<br />' . wfMsg( 'passwordsentforemailauthentication', $u->getName() );
360 $mailmsg = '<br />' . wfMsg( 'mailerror', $error ) ;
366 $wgUser->setCookies();
368 # save all settings (incl. new email address and/or temporary password, if applicable)
369 $wgUser->saveSettings();
371 if ( !$wgEmailAuthentication ||
$alreadyauthenticated ) {
374 } elseif ($u->mEmailAuthenticationtimestamp
!= 0) {
375 $authenticated = ' ' . wfMsg( 'emailauthenticated', $wgLang->timeanddate( $u->mEmailAuthenticationtimestamp
, true ) );
377 $authenticated = ' ' . wfMsg( 'emailnotauthenticated' );
380 if( $this->hasSessionCookie() ) {
381 return $this->successfulLogin( wfMsg( 'loginsuccess', $wgUser->getName() ) . $authenticated . $mailmsg );
383 return $this->cookieRedirectCheck( 'login' );
390 function mailPassword() {
391 global $wgUser, $wgDeferredUpdateList, $wgOutputEncoding;
392 global $wgCookiePath, $wgCookieDomain, $wgDBname;
394 if ( '' == $this->mName
) {
395 $this->mainLoginForm( wfMsg( 'noname' ) );
398 $u = User
::newFromName( $this->mName
);
399 if( is_null( $u ) ) {
400 $this->mainLoginForm( wfMsg( 'noname' ) );
403 if ( 0 == $u->getID() ) {
404 $this->mainLoginForm( wfMsg( 'nosuchuser', $u->getName() ) );
408 $u->loadFromDatabase();
410 $error = $this->mailPasswordInternal( $u, true, $dummy );
412 $this->mainLoginForm( wfMsg( 'passwordsent', $u->getName() ) );
414 $this->mainLoginForm( wfMsg( 'mailerror', $error ) );
423 function mailPasswordInternal( $u, $savesettings = true, &$newpassword_out ) {
424 global $wgPasswordSender, $wgDBname, $wgIP;
425 global $wgCookiePath, $wgCookieDomain;
427 if ( '' == $u->getEmail() ) {
428 return wfMsg( 'noemail', $u->getName() );
431 $np = $u->randomPassword();
432 $u->setNewpassword( $np );
434 # we want to store this new password together with other values in the calling function
435 $newpassword_out = $u->mNewpassword
;
437 # WHY IS THIS HERE ? SHOULDN'T IT BE User::setcookie ???
438 setcookie( "{$wgDBname}Token", '', time() - 3600, $wgCookiePath, $wgCookieDomain );
445 if ( '' == $ip ) { $ip = '(Unknown)'; }
447 $m = wfMsg( 'passwordremindermailbody', $ip, $u->getName(), wfUrlencode($u->getName()), $np );
449 require_once('UserMailer.php');
450 $error = userMailer( $u->getEmail(), $wgPasswordSender, wfMsg( 'passwordremindermailsubject' ), $m );
452 return htmlspecialchars( $error );
457 * @param string $msg Message that will be shown on success.
460 function successfulLogin( $msg ) {
464 # Run any hooks; ignore results
466 wfRunHooks('UserLoginComplete', array(&$wgUser));
468 $wgOut->setPageTitle( wfMsg( 'loginsuccesstitle' ) );
469 $wgOut->setRobotpolicy( 'noindex,nofollow' );
470 $wgOut->setArticleRelated( false );
471 $wgOut->addWikiText( $msg );
472 $wgOut->returnToMain();
476 function userNotPrivilegedMessage() {
479 $wgOut->setPageTitle( wfMsg( 'whitelistacctitle' ) );
480 $wgOut->setRobotpolicy( 'noindex,nofollow' );
481 $wgOut->setArticleRelated( false );
483 $wgOut->addWikiText( wfMsg( 'whitelistacctext' ) );
485 $wgOut->returnToMain( false );
491 function mainLoginForm( $err ) {
492 global $wgUser, $wgOut, $wgLang;
493 global $wgDBname, $wgAllowRealName, $wgEnableEmail;
494 global $wgEmailAuthentication;
496 if ( '' == $this->mName
) {
497 if ( $wgUser->isLoggedIn() ) {
498 $this->mName
= $wgUser->getName();
500 $this->mName
= @$_COOKIE[$wgDBname.'UserName'];
504 $q = 'action=submitlogin';
505 if ( !empty( $this->mReturnto
) ) {
506 $q .= '&returnto=' . wfUrlencode( $this->mReturnto
);
508 $titleObj = Title
::makeTitle( NS_SPECIAL
, 'Userlogin' );
510 require_once( 'templates/Userlogin.php' );
511 $template =& new UserloginTemplate();
513 $template->set( 'name', $this->mName
);
514 $template->set( 'password', $this->mPassword
);
515 $template->set( 'retype', $this->mRetype
);
516 $template->set( 'email', $this->mEmail
);
517 $template->set( 'realname', $this->mRealName
);
519 $template->set( 'action', $titleObj->getLocalUrl( $q ) );
520 $template->set( 'error', $err );
521 $template->set( 'create', $wgUser->isAllowedToCreateAccount() );
522 $template->set( 'createemail', $wgEnableEmail && $wgUser->isLoggedIn() );
523 $template->set( 'userealname', $wgAllowRealName );
524 $template->set( 'useemail', $wgEnableEmail );
525 $template->set( 'useemailauthent', $wgEmailAuthentication );
526 $template->set( 'remember', $wgUser->getOption( 'rememberpassword' ) or $this->mRemember
);
528 $wgOut->setPageTitle( wfMsg( 'userlogin' ) );
529 $wgOut->setRobotpolicy( 'noindex,nofollow' );
530 $wgOut->setArticleRelated( false );
531 $wgOut->addTemplate( $template );
537 function hasSessionCookie() {
538 global $wgDisableCookieCheck;
539 return ( $wgDisableCookieCheck ) ?
true : ( '' != $_COOKIE[session_name()] );
545 function cookieRedirectCheck( $type ) {
546 global $wgOut, $wgLang;
548 $titleObj = Title
::makeTitle( NS_SPECIAL
, 'Userlogin' );
549 $check = $titleObj->getFullURL( 'wpCookieCheck='.$type );
551 return $wgOut->redirect( $check );
557 function onCookieRedirectCheck( $type ) {
560 if ( !$this->hasSessionCookie() ) {
561 if ( $type == 'new' ) {
562 return $this->mainLoginForm( wfMsg( 'nocookiesnew' ) );
563 } else if ( $type == 'login' ) {
564 return $this->mainLoginForm( wfMsg( 'nocookieslogin' ) );
567 return $this->mainLoginForm( wfMsg( 'error' ) );
570 return $this->successfulLogin( wfMsg( 'loginsuccess', $wgUser->getName() ) );
577 function throttleHit( $limit ) {
580 $wgOut->addWikiText( wfMsg( 'acct_creation_throttle_hit', $limit ) );