tweak some comments (schema blah blah)

[lhc/web/wiklou.git] / includes / SpecialPreferences.php

diff --git a/includes/SpecialPreferences.php b/includes/SpecialPreferences.php
index d47ad5c..bfbe8f4 100644 (file)
--- a/includes/SpecialPreferences.php
+++ b/includes/SpecialPreferences.php
@@ -8,7 +8,7 @@
 if( !defined( 'MEDIAWIKI' ) )
        die();
 
-/* to get a list of languages in setting user's language preference */
+/** to get a list of languages in setting user's language preference */
 require_once('languages/Names.php');
 
 /**
@@ -39,7 +39,7 @@ class PreferencesForm {
         * Load some values
         */
        function PreferencesForm( &$request ) { 
-               global $wgLang, $wgContLang, $wgAllowRealName;
+               global $wgLang, $wgContLang, $wgUser, $wgAllowRealName;
                
                $this->mQuickbar = $request->getVal( 'wpQuickbar' );
                $this->mOldpass = $request->getVal( 'wpOldpass' );
@@ -67,7 +67,9 @@ class PreferencesForm {
                $this->mAction = $request->getVal( 'action' );
                $this->mReset = $request->getCheck( 'wpReset' );
                $this->mPosted = $request->wasPosted();
-               $this->mSaveprefs = $request->getCheck( 'wpSaveprefs' ) && $this->mPosted;
+               $this->mSaveprefs = $request->getCheck( 'wpSaveprefs' ) &&
+                       $this->mPosted &&
+                       $wgUser->matchEditToken( $request->getVal( 'wpEditToken' ) );
 
                # User toggles  (the big ugly unsorted list of checkboxes)
                $this->mToggles = array();
@@ -91,12 +93,17 @@ class PreferencesForm {
                                }
                        }
                }
+
+               # Validate language
+               if ( !preg_match( '/^[a-z\-]*$/', $this->mUserLanguage ) ) {
+                       $this->mUserLanguage = 'nolanguage';
+               }
        }
 
        function execute() {
                global $wgUser, $wgOut, $wgUseDynamicDates;
                
-               if ( 0 == $wgUser->getID() ) {
+               if ( $wgUser->isAnon() ) {
                        $wgOut->errorpage( 'prefsnologin', 'prefsnologintext' );
                        return;
                }
@@ -167,7 +174,8 @@ class PreferencesForm {
        function savePreferences() {
                global $wgUser, $wgLang, $wgOut;
                global $wgEnableUserEmail, $wgEnableEmail;
-               global $wgEmailAuthentication;
+               global $wgEmailAuthentication, $wgMinimalPasswordLength;
+;
 
                if ( '' != $this->mNewpass ) {
                        if ( $this->mNewpass != $this->mRetypePass ) {
@@ -175,6 +183,11 @@ class PreferencesForm {
                                return;
                        }
 
+                       if ( strlen( $this->mNewpass ) < $wgMinimalPasswordLength ) {
+                               $this->mainPrefsForm( wfMsg( 'passwordtooshort', $wgMinimalPasswordLength ) );
+                               return;
+                       }
+
                        if (!$wgUser->checkPassword( $this->mOldpass )) {
                                $this->mainPrefsForm( wfMsg( 'wrongpassword' ) );
                                return;
@@ -478,7 +491,7 @@ class PreferencesForm {
                
                $fancysig = $this->getToggle( 'fancysig' );
                $wgOut->addHTML("
-               <div><label>$ynn: <input type='text' name=\"wpNick\" value=\"{$this->mNick}\" size='12' /></label></div>
+               <div><label>$ynn: <input type='text' name=\"wpNick\" value=\"{$this->mNick}\" size='25' /></label></div>
                <div>$fancysig<br /></div>
                <div><label>$yl: <select name=\"wpUserLanguage\">\n");
 
@@ -675,6 +688,7 @@ class PreferencesForm {
                }
                $wgOut->addHTML( "</fieldset>\n\n" );
 
+               $token = htmlspecialchars( $wgUser->editToken() );
                $wgOut->addHTML( "
        <div id='prefsubmit'>
        <div>
@@ -685,6 +699,7 @@ class PreferencesForm {
        
        </div>
        
+       <input type='hidden' name='wpEditToken' value=\"{$token}\" />
        </form>\n" );
        }
 }