(bug 24898) MediaWiki uses /tmp even if a vHost-specific tempdir is set, also make...
[lhc/web/wiklou.git] / includes / User.php
index ac1f7c2..675ccfd 100644 (file)
@@ -42,58 +42,6 @@ class PasswordError extends MWException {
  */
 class User {
 
-       /**
-        * \type{\arrayof{\string}} A list of default user toggles, i.e., boolean user
-         * preferences that are displayed by Special:Preferences as checkboxes.
-        * This list can be extended via the UserToggles hook or by
-        * $wgContLang::getExtraUserToggles().
-        * @showinitializer
-        */
-       public static $mToggles = array(
-               'highlightbroken',
-               'justify',
-               'hideminor',
-               'extendwatchlist',
-               'usenewrc',
-               'numberheadings',
-               'showtoolbar',
-               'editondblclick',
-               'editsection',
-               'editsectiononrightclick',
-               'showtoc',
-               'rememberpassword',
-               'editwidth',
-               'watchcreations',
-               'watchdefault',
-               'watchmoves',
-               'watchdeletion',
-               'minordefault',
-               'previewontop',
-               'previewonfirst',
-               'nocache',
-               'enotifwatchlistpages',
-               'enotifusertalkpages',
-               'enotifminoredits',
-               'enotifrevealaddr',
-               'shownumberswatching',
-               'fancysig',
-               'externaleditor',
-               'externaldiff',
-               'showjumplinks',
-               'uselivepreview',
-               'forceeditsummary',
-               'watchlisthideminor',
-               'watchlisthidebots',
-               'watchlisthideown',
-               'watchlisthideanons',
-               'watchlisthideliu',
-               'ccmeonemails',
-               'diffonly',
-               'showhiddencats',
-               'noconvertlink',
-               'norollbackdiff',
-       );
-
        /**
         * \type{\arrayof{\string}} List of member variables which are saved to the
         * shared cache (memcached). Any operation which changes the
@@ -168,6 +116,7 @@ class User {
                'reupload',
                'reupload-shared',
                'rollback',
+               'selenium',
                'sendemail',
                'siteadmin',
                'suppressionlog',
@@ -216,7 +165,7 @@ class User {
                $mBlockreason, $mBlock, $mEffectiveGroups, $mBlockedGlobally,
                $mLocked, $mHideName, $mOptions;
        //@}
-       
+
        static $idCacheByName = array();
 
        /**
@@ -345,7 +294,8 @@ class User {
         *    User::getCanonicalName(), except that true is accepted as an alias
         *    for 'valid', for BC.
         *
-        * @return \type{User} The User object, or null if the username is invalid. If the
+        * @return \type{User} The User object, or false if the username is invalid 
+        *    (e.g. if it contains illegal characters or is an IP address). If the
         *    username is not present in the database, the result will be a user object
         *    with a name, zero user ID and default settings.
         */
@@ -355,7 +305,7 @@ class User {
                }
                $name = self::getCanonicalName( $name, $validate );
                if ( $name === false ) {
-                       return null;
+                       return false;
                } else {
                        # Create unloaded user object
                        $u = new User;
@@ -435,7 +385,7 @@ class User {
         */
        static function whoIs( $id ) {
                $dbr = wfGetDB( DB_SLAVE );
-               return $dbr->selectField( 'user', 'user_name', array( 'user_id' => $id ), 'User::whoIs' );
+               return $dbr->selectField( 'user', 'user_name', array( 'user_id' => $id ), __METHOD__ );
        }
 
        /**
@@ -599,20 +549,31 @@ class User {
         * either by batch processes or by user accounts which have
         * already been created.
         *
-        * Additional character blacklisting may be added here
-        * rather than in isValidUserName() to avoid disrupting
-        * existing accounts.
+        * Additional blacklisting may be added here rather than in 
+        * isValidUserName() to avoid disrupting existing accounts.
         *
         * @param $name \string String to match
         * @return \bool True or false
         */
        static function isCreatableName( $name ) {
                global $wgInvalidUsernameCharacters;
-               return
-                       self::isUsableName( $name ) &&
 
-                       // Registration-time character blacklisting...
-                       !preg_match( '/[' . preg_quote( $wgInvalidUsernameCharacters, '/' ) . ']/', $name );
+               // Ensure that the username isn't longer than 235 bytes, so that
+               // (at least for the builtin skins) user javascript and css files
+               // will work. (bug 23080)
+               if( strlen( $name ) > 235 ) {
+                       wfDebugLog( 'username', __METHOD__ .
+                               ": '$name' invalid due to length" );
+                       return false;
+               }
+
+               if( preg_match( '/[' . preg_quote( $wgInvalidUsernameCharacters, '/' ) . ']/', $name ) ) {
+                       wfDebugLog( 'username', __METHOD__ .
+                               ": '$name' invalid due to wgInvalidUsernameCharacters" );
+                       return false;
+               }
+
+               return self::isUsableName( $name );
        }
 
        /**
@@ -622,16 +583,8 @@ class User {
         * @return bool True or false
         */
        function isValidPassword( $password ) {
-               global $wgMinimalPasswordLength, $wgContLang;
-
-               if( !wfRunHooks( 'isValidPassword', array( $password, &$result, $this ) ) )
-                       return $result;
-               if( $result === false )
-                       return false;
-               // Password needs to be long enough, and can't be the same as the username
-               return strlen( $password ) >= $wgMinimalPasswordLength
-                       && $wgContLang->lc( $password ) !== $wgContLang->lc( $this->mName );
+               //simple boolean wrapper for getPasswordValidity
+               return $this->getPasswordValidity( $password ) === true;
        }
 
        /**
@@ -642,16 +595,28 @@ class User {
         */
        function getPasswordValidity( $password ) {
                global $wgMinimalPasswordLength, $wgContLang;
-               
-               if(!$this->isValidPassword( $password ))        {
+
+               $result = false; //init $result to false for the internal checks
+
+               if( !wfRunHooks( 'isValidPassword', array( $password, &$result, $this ) ) )
+                       return $result;
+
+               if ( $result === false ) {
                        if( strlen( $password ) < $wgMinimalPasswordLength ) {
                                return 'passwordtooshort';
-                       } elseif( $wgContLang->lc( $password ) == $wgContLang->lc( $this->mName ) ) {
+                       } elseif ( $wgContLang->lc( $password ) == $wgContLang->lc( $this->mName ) ) {
                                return 'password-name-match';
+                       } else {
+                               //it seems weird returning true here, but this is because of the
+                               //initialization of $result to false above. If the hook is never run or it
+                               //doesn't modify $result, then we will likely get down into this if with
+                               //a valid password.
+                               return true;
                        }
-               }
-               else    {
+               } elseif( $result === true ) {
                        return true;
+               } else {
+                       return $result; //the isValidPassword hook set a string $result and returned true
                }
        }
 
@@ -687,8 +652,9 @@ class User {
         *                - 'creatable'  Valid for batch processes, login and account creation
         */
        static function getCanonicalName( $name, $validate = 'valid' ) {
-               # Maybe force usernames to capital
-               $name = Title::capitalize( $name, NS_USER );
+               # Force usernames to capital
+               global $wgContLang;
+               $name = $wgContLang->ucfirst( $name );
 
                # Reject names containing '#'; these will be cleaned up
                # with title normalisation, but then it's too late to
@@ -800,7 +766,7 @@ class User {
        function loadDefaults( $name = false ) {
                wfProfileIn( __METHOD__ );
 
-               global $wgCookiePrefix;
+               global $wgRequest;
 
                $this->mId = 0;
                $this->mName = $name;
@@ -811,8 +777,8 @@ class User {
                $this->mOptionOverrides = null;
                $this->mOptionsLoaded = false;
 
-               if ( isset( $_COOKIE[$wgCookiePrefix.'LoggedOut'] ) ) {
-                       $this->mTouched = wfTimestamp( TS_MW, $_COOKIE[$wgCookiePrefix.'LoggedOut'] );
+               if( $wgRequest->getCookie( 'LoggedOut' ) !== null ) {
+                       $this->mTouched = wfTimestamp( TS_MW, $wgRequest->getCookie( 'LoggedOut' ) );
                } else {
                        $this->mTouched = '0'; # Allow any pages to be cached
                }
@@ -843,7 +809,7 @@ class User {
         * @return \bool True if the user is logged in, false otherwise.
         */
        private function loadFromSession() {
-               global $wgMemc, $wgCookiePrefix;
+               global $wgRequest, $wgExternalAuthType, $wgAutocreatePolicy;
 
                $result = null;
                wfRunHooks( 'UserLoadFromSession', array( $this, &$result ) );
@@ -851,8 +817,16 @@ class User {
                        return $result;
                }
 
-               if ( isset( $_COOKIE["{$wgCookiePrefix}UserID"] ) ) {
-                       $sId = intval( $_COOKIE["{$wgCookiePrefix}UserID"] );
+               if ( $wgExternalAuthType && $wgAutocreatePolicy == 'view' ) {
+                       $extUser = ExternalUser::newFromCookie();
+                       if ( $extUser ) {
+                               # TODO: Automatically create the user here (or probably a bit
+                               # lower down, in fact)
+                       }
+               }
+
+               if ( $wgRequest->getCookie( 'UserID' ) !== null ) {
+                       $sId = intval( $wgRequest->getCookie( 'UserID' ) );
                        if( isset( $_SESSION['wsUserID'] ) && $sId != $_SESSION['wsUserID'] ) {
                                $this->loadDefaults(); // Possible collision!
                                wfDebugLog( 'loginSessions', "Session user ID ({$_SESSION['wsUserID']}) and
@@ -874,8 +848,8 @@ class User {
 
                if ( isset( $_SESSION['wsUserName'] ) ) {
                        $sName = $_SESSION['wsUserName'];
-               } else if ( isset( $_COOKIE["{$wgCookiePrefix}UserName"] ) ) {
-                       $sName = $_COOKIE["{$wgCookiePrefix}UserName"];
+               } else if ( $wgRequest->getCookie('UserName') !== null ) {
+                       $sName = $wgRequest->getCookie('UserName');
                        $_SESSION['wsUserName'] = $sName;
                } else {
                        $this->loadDefaults();
@@ -889,11 +863,18 @@ class User {
                        return false;
                }
 
+               global $wgBlockDisablesLogin;
+               if( $wgBlockDisablesLogin && $this->isBlocked() ) {
+                       # User blocked and we've disabled blocked user logins
+                       $this->loadDefaults();
+                       return false;
+               }
+
                if ( isset( $_SESSION['wsToken'] ) ) {
                        $passwordCorrect = $_SESSION['wsToken'] == $this->mToken;
                        $from = 'session';
-               } else if ( isset( $_COOKIE["{$wgCookiePrefix}Token"] ) ) {
-                       $passwordCorrect = $this->mToken == $_COOKIE["{$wgCookiePrefix}Token"];
+               } else if ( $wgRequest->getCookie( 'Token' ) !== null ) {
+                       $passwordCorrect = $this->mToken == $wgRequest->getCookie( 'Token' );
                        $from = 'cookie';
                } else {
                        # No session or persistent login cookie
@@ -1040,7 +1021,7 @@ class User {
                        $defOpt['searchNs'.$nsnum] = !empty( $wgNamespacesToBeSearchedDefault[$nsnum] );
                }
                $defOpt['skin'] = $wgDefaultSkin;
-               
+
                return $defOpt;
        }
 
@@ -1059,22 +1040,6 @@ class User {
                }
        }
 
-       /**
-        * Get a list of user toggle names
-        * @return \type{\arrayof{\string}} Array of user toggle names
-        */
-       static function getToggles() {
-               global $wgContLang, $wgUseRCPatrol;
-               $extraToggles = array();
-               wfRunHooks( 'UserToggles', array( &$extraToggles ) );
-               if( $wgUseRCPatrol ) {
-                       $extraToggles[] = 'hidepatrolled';
-                       $extraToggles[] = 'newpageshidepatrolled';
-                       $extraToggles[] = 'watchlisthidepatrolled';
-               }
-               return array_merge( self::$mToggles, $extraToggles, $wgContLang->getExtraUserToggles() );
-       }
-
 
        /**
         * Get blocking information
@@ -1085,7 +1050,7 @@ class User {
         *                    done against master.
         */
        function getBlockedStatus( $bFromSlave = true ) {
-               global $wgEnableSorbs, $wgProxyWhitelist, $wgUser;
+               global $wgProxyWhitelist, $wgUser;
 
                if ( -1 != $this->mBlockedby ) {
                        wfDebug( "User::getBlockedStatus: already loaded.\n" );
@@ -1108,7 +1073,7 @@ class User {
 
                # Check if we are looking at an IP or a logged-in user
                if ( $this->isIP( $this->getName() ) ) {
-                       $ip = $this->getName(); 
+                       $ip = $this->getName();
                } else {
                        # Check if we are looking at the current user
                        # If we don't, and the user is logged in, we don't know about
@@ -1132,6 +1097,8 @@ class User {
                if ( $this->mBlock->load( $ip , $this->mId ) ) {
                        wfDebug( __METHOD__ . ": Found block.\n" );
                        $this->mBlockedby = $this->mBlock->mBy;
+                       if( $this->mBlockedby == 0 )
+                               $this->mBlockedby = $this->mBlock->mByName;
                        $this->mBlockreason = $this->mBlock->mReason;
                        $this->mHideName = $this->mBlock->mHideName;
                        $this->mAllowUsertalk = $this->mBlock->mAllowUsertalk;
@@ -1153,8 +1120,8 @@ class User {
                        }
 
                        # DNSBL
-                       if ( !$this->mBlockedby && $wgEnableSorbs && !$this->getID() ) {
-                               if ( $this->inSorbsBlacklist( $ip ) ) {
+                       if ( !$this->mBlockedby && !$this->getID() ) {
+                               if ( $this->isDnsBlacklisted( $ip ) ) {
                                        $this->mBlockedby = wfMsg( 'sorbs' );
                                        $this->mBlockreason = wfMsg( 'sorbsreason' );
                                }
@@ -1168,43 +1135,57 @@ class User {
        }
 
        /**
-        * Whether the given IP is in the SORBS blacklist.
+        * Whether the given IP is in a DNS blacklist.
         *
         * @param $ip \string IP to check
+        * @param $checkWhitelist Boolean: whether to check the whitelist first
         * @return \bool True if blacklisted.
         */
-       function inSorbsBlacklist( $ip ) {
-               global $wgEnableSorbs, $wgSorbsUrl;
+       function isDnsBlacklisted( $ip, $checkWhitelist = false ) {
+               global $wgEnableSorbs, $wgEnableDnsBlacklist,
+                       $wgSorbsUrl, $wgDnsBlacklistUrls, $wgProxyWhitelist;
+
+               if ( !$wgEnableDnsBlacklist && !$wgEnableSorbs )
+                       return false;
+
+               if ( $checkWhitelist && in_array( $ip, $wgProxyWhitelist ) )
+                       return false;
 
-               return $wgEnableSorbs &&
-                       $this->inDnsBlacklist( $ip, $wgSorbsUrl );
+               $urls = array_merge( $wgDnsBlacklistUrls, (array)$wgSorbsUrl );
+               return $this->inDnsBlacklist( $ip, $urls );
        }
 
        /**
         * Whether the given IP is in a given DNS blacklist.
         *
         * @param $ip \string IP to check
-        * @param $base \string URL of the DNS blacklist
+        * @param $bases \string or Array of Strings: URL of the DNS blacklist
         * @return \bool True if blacklisted.
         */
-       function inDnsBlacklist( $ip, $base ) {
+       function inDnsBlacklist( $ip, $bases ) {
                wfProfileIn( __METHOD__ );
 
                $found = false;
                $host = '';
                // FIXME: IPv6 ???  (http://bugs.php.net/bug.php?id=33170)
                if( IP::isIPv4( $ip ) ) {
-                       # Make hostname
-                       $host = "$ip.$base";
+                       # Reverse IP, bug 21255
+                       $ipReversed = implode( '.', array_reverse( explode( '.', $ip ) ) );
 
-                       # Send query
-                       $ipList = gethostbynamel( $host );
+                       foreach( (array)$bases as $base ) {
+                               # Make hostname
+                               $host = "$ipReversed.$base";
 
-                       if( $ipList ) {
-                               wfDebug( "Hostname $host is {$ipList[0]}, it's a proxy says $base!\n" );
-                               $found = true;
-                       } else {
-                               wfDebug( "Requested $host, not found in $base.\n" );
+                               # Send query
+                               $ipList = gethostbynamel( $host );
+
+                               if( $ipList ) {
+                                       wfDebug( "Hostname $host is {$ipList[0]}, it's a proxy says $base!\n" );
+                                       $found = true;
+                                       break;
+                               } else {
+                                       wfDebug( "Requested $host, not found in $base.\n" );
+                               }
                        }
                }
 
@@ -1319,11 +1300,11 @@ class User {
                                } else {
                                        wfDebug( __METHOD__ . ": ok. $key at $count $summary\n" );
                                }
-                               $wgMemc->incr( $key );
                        } else {
                                wfDebug( __METHOD__ . ": adding record for $key $summary\n" );
-                               $wgMemc->set( $key, 1, intval( $period ) ); // first ping
+                               $wgMemc->add( $key, 0, intval( $period ) ); // first ping
                        }
+                       $wgMemc->incr( $key );
                }
 
                wfProfileOut( __METHOD__ );
@@ -1363,9 +1344,9 @@ class User {
                        $blocked = false;
                        wfDebug( __METHOD__ . ": self-talk page, ignoring any blocks\n" );
                }
-               
+
                wfRunHooks( 'UserIsBlockedFrom', array( $this, $title, &$blocked, &$allowUsertalk ) );
-               
+
                wfProfileOut( __METHOD__ );
                return $blocked;
        }
@@ -1760,7 +1741,7 @@ class User {
                        if( !$wgAuth->allowPasswordChange() ) {
                                throw new PasswordError( wfMsg( 'password-change-forbidden' ) );
                        }
+
                        if( !$this->isValidPassword( $str ) ) {
                                global $wgMinimalPasswordLength;
                                $valid = $this->getPasswordValidity( $str );
@@ -1944,6 +1925,16 @@ class User {
                }
        }
 
+       /**
+        * Get all user's options
+        *
+        * @return array
+        */
+       public function getOptions() {
+               $this->loadOptions();
+               return $this->mOptions;
+       }
+
        /**
         * Get the user's current setting for a given option, as a boolean value.
         *
@@ -2021,6 +2012,20 @@ class User {
                return $this->mDatePreference;
        }
 
+       /**
+        * Get the user preferred stub threshold
+        */
+       function getStubThreshold() {
+               global $wgMaxArticleSize; # Maximum article size, in Kb
+               $threshold = intval( $this->getOption( 'stubthreshold' ) );
+               if ( $threshold > $wgMaxArticleSize * 1024 ) {
+                       # If they have set an impossible value, disable the preference 
+                       # so we can use the parser cache again.
+                       $threshold = 0;
+               }
+               return $threshold;
+       }
+
        /**
         * Get the permissions this user has.
         * @return \type{\arrayof{\string}} Array of permission names
@@ -2054,6 +2059,7 @@ class User {
         */
        function getEffectiveGroups( $recache = false ) {
                if ( $recache || is_null( $this->mEffectiveGroups ) ) {
+                       wfProfileIn( __METHOD__ );
                        $this->mEffectiveGroups = $this->getGroups();
                        $this->mEffectiveGroups[] = '*';
                        if( $this->getId() ) {
@@ -2067,6 +2073,7 @@ class User {
                                # Hook for additional groups
                                wfRunHooks( 'UserEffectiveGroups', array( &$this, &$this->mEffectiveGroups ) );
                        }
+                       wfProfileOut( __METHOD__ );
                }
                return $this->mEffectiveGroups;
        }
@@ -2101,7 +2108,7 @@ class User {
                                        'ug_user'  => $this->getID(),
                                        'ug_group' => $group,
                                ),
-                               'User::addGroup',
+                               __METHOD__,
                                array( 'IGNORE' ) );
                }
 
@@ -2124,8 +2131,7 @@ class User {
                        array(
                                'ug_user'  => $this->getID(),
                                'ug_group' => $group,
-                       ),
-                       'User::removeGroup' );
+                       ), __METHOD__ );
 
                $this->loadGroups();
                $this->mGroups = array_diff( $this->mGroups, array( $group ) );
@@ -2219,7 +2225,7 @@ class User {
                                $userSkin = $wgDefaultSkin;
                        }
 
-                       $this->mSkin =& Skin::newFromKey( $userSkin );
+                       $this->mSkin = Skin::newFromKey( $userSkin );
                        wfProfileOut( __METHOD__ );
                }
                if( $t || !$this->mSkin->getTitle() ) {
@@ -2312,7 +2318,7 @@ class User {
                        $dbw = wfGetDB( DB_MASTER );
                        $dbw->update( 'watchlist',
                                        array( /* SET */
-                                               'wl_notificationtimestamp' => NULL
+                                               'wl_notificationtimestamp' => null
                                        ), array( /* WHERE */
                                                'wl_title' => $title->getDBkey(),
                                                'wl_namespace' => $title->getNamespace(),
@@ -2339,7 +2345,7 @@ class User {
                        $dbw = wfGetDB( DB_MASTER );
                        $dbw->update( 'watchlist',
                                array( /* SET */
-                                       'wl_notificationtimestamp' => NULL
+                                       'wl_notificationtimestamp' => null
                                ), array( /* WHERE */
                                        'wl_user' => $currentUser
                                ), __METHOD__
@@ -2484,9 +2490,9 @@ class User {
                                'user_id' => $this->mId
                        ), __METHOD__
                );
-               
+
                $this->saveOptions();
-               
+
                wfRunHooks( 'UserSaveSettings', array( $this ) );
                $this->clearSharedCache();
                $this->getUserPage()->invalidateCache();
@@ -2585,7 +2591,7 @@ class User {
 
                // Clear instance cache other than user table data, which is already accurate
                $this->clearInstanceCache();
-               
+
                $this->saveOptions();
        }
 
@@ -2612,7 +2618,7 @@ class User {
         * Generate a string which will be different for any combination of
         * user options which would produce different parser output.
         * This will be used as part of the hash key for the parser cache,
-        * so users will the same options can share the same cached data
+        * so users with the same options can share the same cached data
         * safely.
         *
         * Extensions which require it should install 'PageRenderingHash' hook,
@@ -2628,11 +2634,12 @@ class User {
                }
 
                // stubthreshold is only included below for completeness,
-               // it will always be 0 when this function is called by parsercache.
+               // since it disables the parser cache, its value will always 
+               // be 0 when this function is called by parsercache.
 
                $confstr =        $this->getOption( 'math' );
-               $confstr .= '!' . $this->getOption( 'stubthreshold' );
-               if ( $wgUseDynamicDates ) {
+               $confstr .= '!' . $this->getStubThreshold();
+               if ( $wgUseDynamicDates ) { # This is wrong (bug 24714)
                        $confstr .= '!' . $this->getDatePreference();
                }
                $confstr .= '!' . ( $this->getOption( 'numberheadings' ) ? '1' : '' );
@@ -2642,6 +2649,9 @@ class User {
                $extra = $wgContLang->getExtraHashOptions();
                $confstr .= $extra;
 
+               // Since the skin could be overloading link(), it should be
+               // included here but in practice, none of our skins do that.
+
                $confstr .= $wgRenderHashAppend;
 
                // Give a chance for extensions to modify the hash, if they have
@@ -2680,13 +2690,6 @@ class User {
                return $this->isAllowed( 'createaccount' ) && !$this->isBlockedFromCreateAccount();
        }
 
-       /**
-        * @deprecated
-        */
-       function setLoaded( $loaded ) {
-               wfDeprecated( __METHOD__ );
-       }
-
        /**
         * Get this user's personal page title.
         *
@@ -2718,7 +2721,7 @@ class User {
                        return $res;
                else {
                        $dbr = wfGetDB( DB_SLAVE );
-                       return $res = $dbr->selectField( 'user', 'max(user_id)', false, 'User::getMaxID' );
+                       return $res = $dbr->selectField( 'user', 'max(user_id)', false, __METHOD__ );
                }
        }
 
@@ -2801,7 +2804,7 @@ class User {
                        return EDIT_TOKEN_SUFFIX;
                } else {
                        if( !isset( $_SESSION['wsEditToken'] ) ) {
-                               $token = $this->generateToken();
+                               $token = self::generateToken();
                                $_SESSION['wsEditToken'] = $token;
                        } else {
                                $token = $_SESSION['wsEditToken'];
@@ -2819,7 +2822,7 @@ class User {
         * @param $salt \string Optional salt value
         * @return \string The new random token
         */
-       function generateToken( $salt = '' ) {
+       public static function generateToken( $salt = '' ) {
                $token = dechex( mt_rand() ) . dechex( mt_rand() );
                return md5( $token . $salt );
        }
@@ -2859,9 +2862,10 @@ class User {
         * Generate a new e-mail confirmation token and send a confirmation/invalidation
         * mail to the user's given address.
         *
+        * @param $changed Boolean: whether the adress changed
         * @return \types{\bool,\type{WikiError}} True on success, a WikiError object on failure.
         */
-       function sendConfirmationMail() {
+       function sendConfirmationMail( $changed = false ) {
                global $wgLang;
                $expiration = null; // gets passed-by-ref and defined in next line.
                $token = $this->confirmationToken( $expiration );
@@ -2869,8 +2873,9 @@ class User {
                $invalidateURL = $this->invalidationTokenUrl( $token );
                $this->saveSettings();
 
+               $message = $changed ? 'confirmemail_body_changed' : 'confirmemail_body';
                return $this->sendMail( wfMsg( 'confirmemail_subject' ),
-                       wfMsg( 'confirmemail_body',
+                       wfMsg( $message,
                                wfGetIP(),
                                $this->getName(),
                                $url,
@@ -2916,7 +2921,7 @@ class User {
                $now = time();
                $expires = $now + 7 * 24 * 60 * 60;
                $expiration = wfTimestamp( TS_MW, $expires );
-               $token = $this->generateToken( $this->mId . $this->mEmail . $expires );
+               $token = self::generateToken( $this->mId . $this->mEmail . $expires );
                $hash = md5( $token );
                $this->load();
                $this->mEmailToken = $hash;
@@ -3009,8 +3014,8 @@ class User {
         * @return \bool True if allowed
         */
        function canSendEmail() {
-               global $wgEnableEmail, $wgEnableUserEmail, $wgUser;
-               if( !$wgEnableEmail || !$wgEnableUserEmail || !$wgUser->isAllowed( 'sendemail' ) ) {
+               global $wgEnableEmail, $wgEnableUserEmail;
+               if( !$wgEnableEmail || !$wgEnableUserEmail || !$this->isAllowed( 'sendemail' ) ) {
                        return false;
                }
                $canSend = $this->isEmailConfirmed();
@@ -3147,8 +3152,6 @@ class User {
         * @return \string Localized descriptive group name
         */
        static function getGroupName( $group ) {
-               global $wgMessageCache;
-               $wgMessageCache->loadAllMessages();
                $key = "group-$group";
                $name = wfMsg( $key );
                return $name == '' || wfEmptyMsg( $key, $name )
@@ -3163,8 +3166,6 @@ class User {
         * @return \string Localized name for group member
         */
        static function getGroupMember( $group ) {
-               global $wgMessageCache;
-               $wgMessageCache->loadAllMessages();
                $key = "group-$group-member";
                $name = wfMsg( $key );
                return $name == '' || wfEmptyMsg( $key, $name )
@@ -3221,8 +3222,6 @@ class User {
         * @return \types{\type{Title},\bool} Title of the page if it exists, false otherwise
         */
        static function getGroupPage( $group ) {
-               global $wgMessageCache;
-               $wgMessageCache->loadAllMessages();
                $page = wfMsgForContent( 'grouppage-' . $group );
                if( !wfEmptyMsg( 'grouppage-' . $group, $page ) ) {
                        $title = Title::newFromText( $page );
@@ -3435,8 +3434,6 @@ class User {
         * @return \string Localized description of the right
         */
        static function getRightDescription( $right ) {
-               global $wgMessageCache;
-               $wgMessageCache->loadAllMessages();
                $key = "right-$right";
                $name = wfMsg( $key );
                return $name == '' || wfEmptyMsg( $key, $name )
@@ -3496,7 +3493,6 @@ class User {
         * @return \bool
         */
        static function comparePasswords( $hash, $password, $userId = false ) {
-               $m = false;
                $type = substr( $hash, 0, 3 );
 
                $result = false;
@@ -3519,28 +3515,34 @@ class User {
 
        /**
         * Add a newuser log entry for this user
+        *
         * @param $byEmail Boolean: account made by email?
+        * @param $reason String: user supplied reason
         */
-       public function addNewUserLogEntry( $byEmail = false ) {
+       public function addNewUserLogEntry( $byEmail = false, $reason = '' ) {
                global $wgUser, $wgContLang, $wgNewUserLog;
                if( empty( $wgNewUserLog ) ) {
                        return true; // disabled
                }
-               $talk = $wgContLang->getFormattedNsText( NS_TALK );
+
                if( $this->getName() == $wgUser->getName() ) {
                        $action = 'create';
-                       $message = '';
                } else {
                        $action = 'create2';
-                       $message = $byEmail 
-                               ? wfMsgForContent( 'newuserlog-byemail' ) 
-                               : '';
+                       if ( $byEmail ) {
+                               if ( $reason === '' ) {
+                                       $reason = wfMsgForContent( 'newuserlog-byemail' );
+                               } else {
+                                       $reason = $wgContLang->commaList( array(
+                                               $reason, wfMsgForContent( 'newuserlog-byemail' ) ) );
+                               }
+                       }
                }
                $log = new LogPage( 'newusers' );
                $log->addEntry(
                        $action,
                        $this->getUserPage(),
-                       $message,
+                       $reason,
                        array( $this->getId() )
                );
                return true;
@@ -3551,8 +3553,8 @@ class User {
         * Used by things like CentralAuth and perhaps other authplugins.
         */
        public function addNewUserLogEntryAutoCreate() {
-               global $wgNewUserLog;
-               if( empty( $wgNewUserLog ) ) {
+               global $wgNewUserLog, $wgLogAutocreatedAccounts;
+               if( !$wgNewUserLog || !$wgLogAutocreatedAccounts ) {
                        return true; // disabled
                }
                $log = new LogPage( 'newusers', false );
@@ -3569,7 +3571,7 @@ class User {
 
                // Maybe load from the object
                if ( !is_null( $this->mOptionOverrides ) ) {
-                       wfDebug( "Loading options for user " . $this->getId() . " from override cache.\n" ); 
+                       wfDebug( "Loading options for user " . $this->getId() . " from override cache.\n" );
                        foreach( $this->mOptionOverrides as $key => $value ) {
                                $this->mOptions[$key] = $value;
                        }
@@ -3603,11 +3605,11 @@ class User {
 
                $this->loadOptions();
                $dbw = wfGetDB( DB_MASTER );
-               
+
                $insert_rows = array();
-               
+
                $saveOptions = $this->mOptions;
-               
+
                // Allow hooks to abort, for instance to save to a global profile.
                // Reset options to default state before saving.
                if( !wfRunHooks( 'UserSaveOptions', array( $this, &$saveOptions ) ) )
@@ -3643,7 +3645,7 @@ class User {
        }
 
        /**
-        * Provide an array of HTML 5 attributes to put on an input element
+        * Provide an array of HTML5 attributes to put on an input element
         * intended for the user to enter a new password.  This may include
         * required, title, and/or pattern, depending on $wgMinimalPasswordLength.
         *
@@ -3655,6 +3657,10 @@ class User {
         *
         * Obviously, you still need to do server-side checking.
         *
+        * NOTE: A combination of bugs in various browsers means that this function
+        * actually just returns array() unconditionally at the moment.  May as
+        * well keep it around for when the browser bugs get fixed, though.
+        *
         * @return array Array of HTML attributes suitable for feeding to
         *   Html::element(), directly or indirectly.  (Don't feed to Xml::*()!
         *   That will potentially output invalid XHTML 1.0 Transitional, and will
@@ -3669,7 +3675,14 @@ class User {
 
                # Note that the pattern requirement will always be satisfied if the
                # input is empty, so we need required in all cases.
-               $ret = array( 'required' );
+               #
+               # FIXME (bug 23769): This needs to not claim the password is required
+               # if e-mail confirmation is being used.  Since HTML5 input validation
+               # is b0rked anyway in some browsers, just return nothing.  When it's
+               # re-enabled, fix this code to not output required for e-mail
+               # registration.
+               #$ret = array( 'required' );
+               $ret = array();
 
                # We can't actually do this right now, because Opera 9.6 will print out
                # the entered password visibly in its error message!  When other
@@ -3687,4 +3700,92 @@ class User {
 
                return $ret;
        }
+
+       /**
+        * Format the user message using a hook, a template, or, failing these, a static format.
+        * @param $subject   String the subject of the message
+        * @param $text      String the content of the message
+        * @param $signature String the signature, if provided.
+        */
+       static protected function formatUserMessage( $subject, $text, $signature ) {
+               if ( wfRunHooks( 'FormatUserMessage',
+                               array( $subject, &$text, $signature ) ) ) {
+
+                       $signature = empty($signature) ? "~~~~~" : "{$signature} ~~~~~";
+
+                       $template = Title::newFromText( wfMsgForContent( 'usermessage-template' ) );
+                       if ( !$template
+                                       || $template->getNamespace() !== NS_TEMPLATE
+                                       || !$template->exists() ) {
+                               $text = "\n== $subject ==\n\n$text\n\n-- $signature";
+                       } else {
+                               $text = '{{'. $template->getText()
+                                       . " | subject=$subject | body=$text | signature=$signature }}";
+                       }
+               }
+
+               return $text;
+       }
+
+       /**
+        * Leave a user a message
+        * @param $subject String the subject of the message
+        * @param $text String the message to leave
+        * @param $signature String Text to leave in the signature
+        * @param $summary String the summary for this change, defaults to
+        *                        "Leave system message."
+        * @param $editor User The user leaving the message, defaults to
+        *                        "{{MediaWiki:usermessage-editor}}"
+        * @param $flags Int default edit flags
+        *
+        * @return boolean true if it was successful
+        */
+       public function leaveUserMessage( $subject, $text, $signature = "",
+                       $summary = null, $editor = null, $flags = 0 ) {
+               if ( !isset( $summary ) ) {
+                       $summary = wfMsgForContent( 'usermessage-summary' );
+               }
+
+               if ( !isset( $editor ) ) {
+                       $editor = User::newFromName( wfMsgForContent( 'usermessage-editor' ) );
+                       if ( !$editor->isLoggedIn() ) {
+                               $editor->addToDatabase();
+                       }
+               }
+
+               $article = new Article( $this->getTalkPage() );
+               wfRunHooks( 'SetupUserMessageArticle',
+                       array( $this, &$article, $subject, $text, $signature, $summary, $editor ) );
+
+
+               $text = self::formatUserMessage( $subject, $text, $signature );
+               $flags = $article->checkFlags( $flags );
+
+               if ( $flags & EDIT_UPDATE ) {
+                       $text = $article->getContent() . $text;
+               }
+
+               $dbw = wfGetDB( DB_MASTER );
+               $dbw->begin();
+
+               try {
+                       $status = $article->doEdit( $text, $summary, $flags, false, $editor );
+               } catch ( DBQueryError $e ) {
+                       $status = Status::newFatal("DB Error");
+               }
+
+               if ( $status->isGood() ) {
+                       // Set newtalk with the right user ID
+                       $this->setNewtalk( true );
+                       wfRunHooks( 'AfterUserMessage',
+                               array( $this, $article, $summary, $text, $signature, $summary, $editor ) );
+                       $dbw->commit();
+               } else {
+                       // The article was concurrently created
+                       wfDebug( __METHOD__ . ": Error ".$status->getWikiText() );
+                       $dbw->rollback();
+               }
+
+               return $status->isGood();
+       }
 }