includes/specials/SpecialChangePassword.php

   1 <?php
   2 /**
   3  * Implements Special:ChangePassword
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License along
  16  * with this program; if not, write to the Free Software Foundation, Inc.,
  17  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  18  * http://www.gnu.org/copyleft/gpl.html
  19  *
  20  * @file
  21  * @ingroup SpecialPage
  22  */
  23
  24 /**
  25  * Let users recover their password.
  26  *
  27  * @ingroup SpecialPage
  28  */
  29 class SpecialChangePassword extends FormSpecialPage {
  30
  31         protected $mUserName, $mDomain;
  32
  33         // Optional Wikitext Message to show above the password change form
  34         protected $mPreTextMessage = null;
  35
  36         // label for old password input
  37         protected $mOldPassMsg = null;
  38
  39         public function __construct() {
  40                 parent::__construct( 'ChangePassword', 'editmyprivateinfo' );
  41                 $this->listed( false );
  42         }
  43
  44         /**
  45          * Main execution point
  46          */
  47         function execute( $par ) {
  48                 $this->getOutput()->disallowUserJs();
  49
  50                 parent::execute( $par );
  51         }
  52
  53         protected function checkExecutePermissions( User $user ) {
  54                 parent::checkExecutePermissions( $user );
  55
  56                 if ( !$this->getRequest()->wasPosted() ) {
  57                         $this->requireLogin( 'resetpass-no-info' );
  58                 }
  59         }
  60
  61         /**
  62          * Set a message at the top of the Change Password form
  63          * @since 1.23
  64          * @param Message $msg to parse and add to the form header
  65          */
  66         public function setChangeMessage( Message $msg ) {
  67                 $this->mPreTextMessage = $msg;
  68         }
  69
  70         /**
  71          * Set a message at the top of the Change Password form
  72          * @since 1.23
  73          * @param string $msg Message label for old/temp password field
  74          */
  75         public function setOldPasswordMessage( $msg ) {
  76                 $this->mOldPassMsg = $msg;
  77         }
  78
  79         protected function getFormFields() {
  80                 global $wgCookieExpiration;
  81
  82                 $user = $this->getUser();
  83                 $request = $this->getRequest();
  84
  85                 $oldpassMsg = $this->mOldPassMsg;
  86                 if ( !isset( $oldpassMsg ) ) {
  87                         $oldpassMsg = $user->isLoggedIn() ? 'oldpassword' : 'resetpass-temp-password';
  88                 }
  89
  90                 $fields = array(
  91                         'Name' => array(
  92                                 'type' => 'info',
  93                                 'label-message' => 'username',
  94                                 'default' => $request->getVal( 'wpName', $user->getName() ),
  95                         ),
  96                         'Password' => array(
  97                                 'type' => 'password',
  98                                 'label-message' => $oldpassMsg,
  99                         ),
 100                         'NewPassword' => array(
 101                                 'type' => 'password',
 102                                 'label-message' => 'newpassword',
 103                         ),
 104                         'Retype' => array(
 105                                 'type' => 'password',
 106                                 'label-message' => 'retypenew',
 107                         ),
 108                 );
 109
 110                 $extraFields = array();
 111                 wfRunHooks( 'ChangePasswordForm', array( &$extraFields ) );
 112                 foreach ( $extraFields as $extra ) {
 113                         list( $name, $label, $type, $default ) = $extra;
 114                         $fields[$name] = array(
 115                                 'type' => $type,
 116                                 'name' => $name,
 117                                 'label-message' => $label,
 118                                 'default' => $default,
 119                         );
 120                 }
 121
 122                 if ( !$user->isLoggedIn() ) {
 123                         $fields['Remember'] = array(
 124                                 'type' => 'check',
 125                                 'label' => $this->msg( 'remembermypassword' )
 126                                                 ->numParams( ceil( $wgCookieExpiration / ( 3600 * 24 ) ) )
 127                                                 ->text(),
 128                                 'default' => $request->getVal( 'wpRemember' ),
 129                         );
 130                 }
 131
 132                 return $fields;
 133         }
 134
 135         protected function alterForm( HTMLForm $form ) {
 136                 $form->setId( 'mw-resetpass-form' );
 137                 $form->setTableId( 'mw-resetpass-table' );
 138                 $form->setWrapperLegendMsg( 'resetpass_header' );
 139                 $form->setSubmitTextMsg(
 140                         $this->getUser()->isLoggedIn()
 141                                 ? 'resetpass-submit-loggedin'
 142                                 : 'resetpass_submit'
 143                 );
 144                 $form->addButton( 'wpCancel',  $this->msg( 'resetpass-submit-cancel' )->text() );
 145                 $form->setHeaderText( $this->msg( 'resetpass_text' )->parseAsBlock() );
 146                 if ( $this->mPreTextMessage instanceof Message ) {
 147                         $form->addPreText( $this->mPreTextMessage->parseAsBlock() );
 148                 }
 149                 $form->addHiddenFields(
 150                         $this->getRequest()->getValues( 'wpName', 'wpDomain', 'returnto', 'returntoquery' ) );
 151         }
 152
 153         public function onSubmit( array $data ) {
 154                 global $wgAuth;
 155
 156                 $request = $this->getRequest();
 157
 158                 if ( $request->getCheck( 'wpLoginToken' ) ) {
 159                         // This comes from Special:Userlogin when logging in with a temporary password
 160                         return false;
 161                 }
 162
 163                 if ( $request->getCheck( 'wpCancel' ) ) {
 164                         $titleObj = Title::newFromText( $request->getVal( 'returnto' ) );
 165                         if ( !$titleObj instanceof Title ) {
 166                                 $titleObj = Title::newMainPage();
 167                         }
 168                         $query = $request->getVal( 'returntoquery' );
 169                         $this->getOutput()->redirect( $titleObj->getFullURL( $query ) );
 170                         return true;
 171                 }
 172
 173                 try {
 174                         $this->mUserName = $request->getVal( 'wpName', $this->getUser()->getName() );
 175                         $this->mDomain = $wgAuth->getDomain();
 176
 177                         if ( !$wgAuth->allowPasswordChange() ) {
 178                                 throw new ErrorPageError( 'changepassword', 'resetpass_forbidden' );
 179                         }
 180
 181                         $this->attemptReset( $data['Password'], $data['NewPassword'], $data['Retype'] );
 182
 183                         return true;
 184                 } catch ( PasswordError $e ) {
 185                         return $e->getMessage();
 186                 }
 187         }
 188
 189         public function onSuccess() {
 190                 if ( $this->getUser()->isLoggedIn() ) {
 191                         $this->getOutput()->wrapWikiMsg(
 192                                 "<div class=\"successbox\">\n$1\n</div>",
 193                                 'changepassword-success'
 194                         );
 195                         $this->getOutput()->returnToMain();
 196                 } else {
 197                         $request = $this->getRequest();
 198                         LoginForm::setLoginToken();
 199                         $token = LoginForm::getLoginToken();
 200                         $data = array(
 201                                 'action' => 'submitlogin',
 202                                 'wpName' => $this->mUserName,
 203                                 'wpDomain' => $this->mDomain,
 204                                 'wpLoginToken' => $token,
 205                                 'wpPassword' => $request->getVal( 'wpNewPassword' ),
 206                         ) + $request->getValues( 'wpRemember', 'returnto', 'returntoquery' );
 207                         $login = new LoginForm( new DerivativeRequest( $request, $data, true ) );
 208                         $login->setContext( $this->getContext() );
 209                         $login->execute( null );
 210                 }
 211         }
 212
 213         /**
 214          * @throws PasswordError when cannot set the new password because requirements not met.
 215          */
 216         protected function attemptReset( $oldpass, $newpass, $retype ) {
 217                 global $wgPasswordAttemptThrottle;
 218
 219                 $isSelf = ( $this->mUserName === $this->getUser()->getName() );
 220                 if ( $isSelf ) {
 221                         $user = $this->getUser();
 222                 } else {
 223                         $user = User::newFromName( $this->mUserName );
 224                 }
 225
 226                 if ( !$user || $user->isAnon() ) {
 227                         throw new PasswordError( $this->msg( 'nosuchusershort', $this->mUserName )->text() );
 228                 }
 229
 230                 if ( $newpass !== $retype ) {
 231                         wfRunHooks( 'PrefsPasswordAudit', array( $user, $newpass, 'badretype' ) );
 232                         throw new PasswordError( $this->msg( 'badretype' )->text() );
 233                 }
 234
 235                 $throttleCount = LoginForm::incLoginThrottle( $this->mUserName );
 236                 if ( $throttleCount === true ) {
 237                         $lang = $this->getLanguage();
 238                         throw new PasswordError( $this->msg( 'changepassword-throttled' )
 239                                 ->params( $lang->formatDuration( $wgPasswordAttemptThrottle['seconds'] ) )
 240                                 ->text()
 241                         );
 242                 }
 243
 244                 // @TODO Make these separate messages, since the message is written for both cases
 245                 if ( !$user->checkTemporaryPassword( $oldpass ) && !$user->checkPassword( $oldpass ) ) {
 246                         wfRunHooks( 'PrefsPasswordAudit', array( $user, $newpass, 'wrongpassword' ) );
 247                         throw new PasswordError( $this->msg( 'resetpass-wrong-oldpass' )->text() );
 248                 }
 249
 250                 // User is resetting their password to their old password
 251                 if ( $oldpass === $newpass ) {
 252                         throw new PasswordError( $this->msg( 'resetpass-recycled' )->text() );
 253                 }
 254
 255                 // Do AbortChangePassword after checking mOldpass, so we don't leak information
 256                 // by possibly aborting a new password before verifying the old password.
 257                 $abortMsg = 'resetpass-abort-generic';
 258                 if ( !wfRunHooks( 'AbortChangePassword', array( $user, $oldpass, $newpass, &$abortMsg ) ) ) {
 259                         wfRunHooks( 'PrefsPasswordAudit', array( $user, $newpass, 'abortreset' ) );
 260                         throw new PasswordError( $this->msg( $abortMsg )->text() );
 261                 }
 262
 263                 // Please reset throttle for successful logins, thanks!
 264                 if ( $throttleCount ) {
 265                         LoginForm::clearLoginThrottle( $this->mUserName );
 266                 }
 267
 268                 try {
 269                         $user->setPassword( $newpass );
 270                         wfRunHooks( 'PrefsPasswordAudit', array( $user, $newpass, 'success' ) );
 271                 } catch ( PasswordError $e ) {
 272                         wfRunHooks( 'PrefsPasswordAudit', array( $user, $newpass, 'error' ) );
 273                         throw new PasswordError( $e->getMessage() );
 274                 }
 275
 276                 if ( $isSelf ) {
 277                         // This is needed to keep the user connected since
 278                         // changing the password also modifies the user's token.
 279                         $user->setCookies();
 280                 }
 281                 $user->resetPasswordExpiration();
 282                 $user->saveSettings();
 283         }
 284
 285         public function requiresUnblock() {
 286                 return false;
 287         }
 288
 289         protected function getGroupName() {
 290                 return 'users';
 291         }
 292 }