includes/specials/SpecialChangePassword.php

   1 <?php
   2 /**
   3  * Implements Special:ChangePassword
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License along
  16  * with this program; if not, write to the Free Software Foundation, Inc.,
  17  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  18  * http://www.gnu.org/copyleft/gpl.html
  19  *
  20  * @file
  21  * @ingroup SpecialPage
  22  */
  23
  24 /**
  25  * Let users recover their password.
  26  *
  27  * @ingroup SpecialPage
  28  */
  29 class SpecialChangePassword extends FormSpecialPage {
  30
  31         protected $mUserName, $mDomain;
  32
  33         public function __construct() {
  34                 parent::__construct( 'ChangePassword', 'editmyprivateinfo' );
  35                 $this->listed( false );
  36         }
  37
  38         /**
  39          * Main execution point
  40          */
  41         function execute( $par ) {
  42                 $this->getOutput()->disallowUserJs();
  43
  44                 parent::execute( $par );
  45         }
  46
  47         protected function checkExecutePermissions( User $user ) {
  48                 parent::checkExecutePermissions( $user );
  49
  50                 if ( !$this->getRequest()->wasPosted() ) {
  51                         $this->requireLogin( 'resetpass-no-info' );
  52                 }
  53         }
  54
  55         protected function getFormFields() {
  56                 global $wgCookieExpiration;
  57
  58                 $user = $this->getUser();
  59                 $request = $this->getRequest();
  60
  61                 $oldpassMsg = $user->isLoggedIn() ? 'oldpassword' : 'resetpass-temp-password';
  62
  63                 $fields = array(
  64                         'Name' => array(
  65                                 'type' => 'info',
  66                                 'label-message' => 'username',
  67                                 'default' => $request->getVal( 'wpName', $user->getName() ),
  68                         ),
  69                         'Password' => array(
  70                                 'type' => 'password',
  71                                 'label-message' => $oldpassMsg,
  72                         ),
  73                         'NewPassword' => array(
  74                                 'type' => 'password',
  75                                 'label-message' => 'newpassword',
  76                         ),
  77                         'Retype' => array(
  78                                 'type' => 'password',
  79                                 'label-message' => 'retypenew',
  80                         ),
  81                 );
  82
  83                 $extraFields = array();
  84                 wfRunHooks( 'ChangePasswordForm', array( &$extraFields ) );
  85                 foreach ( $extraFields as $extra ) {
  86                         list( $name, $label, $type, $default ) = $extra;
  87                         $fields[$name] = array(
  88                                 'type' => $type,
  89                                 'name' => $name,
  90                                 'label-message' => $label,
  91                                 'default' => $default,
  92                         );
  93                 }
  94
  95                 if ( !$user->isLoggedIn() ) {
  96                         $fields['Remember'] = array(
  97                                 'type' => 'check',
  98                                 'label' => $this->msg( 'remembermypassword' )
  99                                                 ->numParams( ceil( $wgCookieExpiration / ( 3600 * 24 ) ) )
 100                                                 ->text(),
 101                                 'default' => $request->getVal( 'wpRemember' ),
 102                         );
 103                 }
 104
 105                 return $fields;
 106         }
 107
 108         protected function alterForm( HTMLForm $form ) {
 109                 $form->setId( 'mw-resetpass-form' );
 110                 $form->setTableId( 'mw-resetpass-table' );
 111                 $form->setWrapperLegendMsg( 'resetpass_header' );
 112                 $form->setSubmitTextMsg(
 113                         $this->getUser()->isLoggedIn()
 114                                 ? 'resetpass-submit-loggedin'
 115                                 : 'resetpass_submit'
 116                 );
 117                 $form->addButton( 'wpCancel',  $this->msg( 'resetpass-submit-cancel' )->text() );
 118                 $form->setHeaderText( $this->msg( 'resetpass_text' )->parseAsBlock() );
 119                 $form->addHiddenFields(
 120                         $this->getRequest()->getValues( 'wpName', 'wpDomain', 'returnto', 'returntoquery' ) );
 121         }
 122
 123         public function onSubmit( array $data ) {
 124                 global $wgAuth;
 125
 126                 $request = $this->getRequest();
 127
 128                 if ( $request->getCheck( 'wpLoginToken' ) ) {
 129                         // This comes from Special:Userlogin when logging in with a temporary password
 130                         return false;
 131                 }
 132
 133                 if ( $request->getCheck( 'wpCancel' ) ) {
 134                         $titleObj = Title::newFromText( $request->getVal( 'returnto' ) );
 135                         if ( !$titleObj instanceof Title ) {
 136                                 $titleObj = Title::newMainPage();
 137                         }
 138                         $query = $request->getVal( 'returntoquery' );
 139                         $this->getOutput()->redirect( $titleObj->getFullURL( $query ) );
 140                         return true;
 141                 }
 142
 143                 try {
 144                         $this->mUserName = $request->getVal( 'wpName', $this->getUser()->getName() );
 145                         $this->mDomain = $wgAuth->getDomain();
 146
 147                         if ( !$wgAuth->allowPasswordChange() ) {
 148                                 throw new ErrorPageError( 'changepassword', 'resetpass_forbidden' );
 149                         }
 150
 151                         $this->attemptReset( $data['Password'], $data['NewPassword'], $data['Retype'] );
 152
 153                         return true;
 154                 } catch ( PasswordError $e ) {
 155                         return $e->getMessage();
 156                 }
 157         }
 158
 159         public function onSuccess() {
 160                 if ( $this->getUser()->isLoggedIn() ) {
 161                         $this->getOutput()->wrapWikiMsg(
 162                                 "<div class=\"successbox\">\n$1\n</div>",
 163                                 'changepassword-success'
 164                         );
 165                         $this->getOutput()->returnToMain();
 166                 } else {
 167                         $request = $this->getRequest();
 168                         LoginForm::setLoginToken();
 169                         $token = LoginForm::getLoginToken();
 170                         $data = array(
 171                                 'action' => 'submitlogin',
 172                                 'wpName' => $this->mUserName,
 173                                 'wpDomain' => $this->mDomain,
 174                                 'wpLoginToken' => $token,
 175                                 'wpPassword' => $request->getVal( 'wpNewPassword' ),
 176                         ) + $request->getValues( 'wpRemember', 'returnto', 'returntoquery' );
 177                         $login = new LoginForm( new DerivativeRequest( $request, $data, true ) );
 178                         $login->setContext( $this->getContext() );
 179                         $login->execute( null );
 180                 }
 181         }
 182
 183         /**
 184          * @throws PasswordError when cannot set the new password because requirements not met.
 185          */
 186         protected function attemptReset( $oldpass, $newpass, $retype ) {
 187                 global $wgPasswordAttemptThrottle;
 188
 189                 $isSelf = ( $this->mUserName === $this->getUser()->getName() );
 190                 if ( $isSelf ) {
 191                         $user = $this->getUser();
 192                 } else {
 193                         $user = User::newFromName( $this->mUserName );
 194                 }
 195
 196                 if ( !$user || $user->isAnon() ) {
 197                         throw new PasswordError( $this->msg( 'nosuchusershort', $this->mUserName )->text() );
 198                 }
 199
 200                 if ( $newpass !== $retype ) {
 201                         wfRunHooks( 'PrefsPasswordAudit', array( $user, $newpass, 'badretype' ) );
 202                         throw new PasswordError( $this->msg( 'badretype' )->text() );
 203                 }
 204
 205                 $throttleCount = LoginForm::incLoginThrottle( $this->mUserName );
 206                 if ( $throttleCount === true ) {
 207                         $lang = $this->getLanguage();
 208                         throw new PasswordError( $this->msg( 'login-throttled' )
 209                                 ->params( $lang->formatDuration( $wgPasswordAttemptThrottle['seconds'] ) )
 210                                 ->text()
 211                         );
 212                 }
 213
 214                 $abortMsg = 'resetpass-abort-generic';
 215                 if ( !wfRunHooks( 'AbortChangePassword', array( $user, $oldpass, $newpass, &$abortMsg ) ) ) {
 216                         wfRunHooks( 'PrefsPasswordAudit', array( $user, $newpass, 'abortreset' ) );
 217                         throw new PasswordError( $this->msg( $abortMsg )->text() );
 218                 }
 219
 220                 if ( !$user->checkTemporaryPassword( $oldpass ) && !$user->checkPassword( $oldpass ) ) {
 221                         wfRunHooks( 'PrefsPasswordAudit', array( $user, $newpass, 'wrongpassword' ) );
 222                         throw new PasswordError( $this->msg( 'resetpass-wrong-oldpass' )->text() );
 223                 }
 224
 225                 // Please reset throttle for successful logins, thanks!
 226                 if ( $throttleCount ) {
 227                         LoginForm::clearLoginThrottle( $this->mUserName );
 228                 }
 229
 230                 try {
 231                         $user->setPassword( $newpass );
 232                         wfRunHooks( 'PrefsPasswordAudit', array( $user, $newpass, 'success' ) );
 233                 } catch ( PasswordError $e ) {
 234                         wfRunHooks( 'PrefsPasswordAudit', array( $user, $newpass, 'error' ) );
 235                         throw new PasswordError( $e->getMessage() );
 236                 }
 237
 238                 if ( $isSelf ) {
 239                         // This is needed to keep the user connected since
 240                         // changing the password also modifies the user's token.
 241                         $user->setCookies();
 242                 }
 243
 244                 $user->saveSettings();
 245         }
 246
 247         public function requiresUnblock() {
 248                 return false;
 249         }
 250
 251         protected function getGroupName() {
 252                 return 'users';
 253         }
 254 }