Merge "mediawiki.debug: Migrate CSS to LESS"

[lhc/web/wiklou.git] / includes / specials / SpecialChangePassword.php

diff --git a/includes/specials/SpecialChangePassword.php b/includes/specials/SpecialChangePassword.php
index d54828a..47f5b1e 100644 (file)
--- a/includes/specials/SpecialChangePassword.php
+++ b/includes/specials/SpecialChangePassword.php
@@ -30,6 +30,12 @@ class SpecialChangePassword extends FormSpecialPage {
 
        protected $mUserName, $mDomain;
 
+       // Optional Wikitext Message to show above the password change form
+       protected $mPreTextMessage = null;
+
+       // label for old password input
+       protected $mOldPassMsg = null;
+
        public function __construct() {
                parent::__construct( 'ChangePassword', 'editmyprivateinfo' );
                $this->listed( false );
@@ -52,13 +58,34 @@ class SpecialChangePassword extends FormSpecialPage {
                }
        }
 
+       /**
+        * Set a message at the top of the Change Password form
+        * @since 1.23
+        * @param Message $msg to parse and add to the form header
+        */
+       public function setChangeMessage( Message $msg ) {
+               $this->mPreTextMessage = $msg;
+       }
+
+       /**
+        * Set a message at the top of the Change Password form
+        * @since 1.23
+        * @param string $msg Message label for old/temp password field
+        */
+       public function setOldPasswordMessage( $msg ) {
+               $this->mOldPassMsg = $msg;
+       }
+
        protected function getFormFields() {
                global $wgCookieExpiration;
 
                $user = $this->getUser();
                $request = $this->getRequest();
 
-               $oldpassMsg = $user->isLoggedIn() ? 'oldpassword' : 'resetpass-temp-password';
+               $oldpassMsg = $this->mOldPassMsg;
+               if ( !isset( $oldpassMsg ) ) {
+                       $oldpassMsg = $user->isLoggedIn() ? 'oldpassword' : 'resetpass-temp-password';
+               }
 
                $fields = array(
                        'Name' => array(
@@ -116,6 +143,9 @@ class SpecialChangePassword extends FormSpecialPage {
                );
                $form->addButton( 'wpCancel',  $this->msg( 'resetpass-submit-cancel' )->text() );
                $form->setHeaderText( $this->msg( 'resetpass_text' )->parseAsBlock() );
+               if ( $this->mPreTextMessage instanceof Message ) {
+                       $form->addPreText( $this->mPreTextMessage->parseAsBlock() );
+               }
                $form->addHiddenFields(
                        $this->getRequest()->getValues( 'wpName', 'wpDomain', 'returnto', 'returntoquery' ) );
        }
@@ -205,23 +235,31 @@ class SpecialChangePassword extends FormSpecialPage {
                $throttleCount = LoginForm::incLoginThrottle( $this->mUserName );
                if ( $throttleCount === true ) {
                        $lang = $this->getLanguage();
-                       throw new PasswordError( $this->msg( 'login-throttled' )
+                       throw new PasswordError( $this->msg( 'changepassword-throttled' )
                                ->params( $lang->formatDuration( $wgPasswordAttemptThrottle['seconds'] ) )
                                ->text()
                        );
                }
 
+               // @TODO Make these separate messages, since the message is written for both cases
+               if ( !$user->checkTemporaryPassword( $oldpass ) && !$user->checkPassword( $oldpass ) ) {
+                       wfRunHooks( 'PrefsPasswordAudit', array( $user, $newpass, 'wrongpassword' ) );
+                       throw new PasswordError( $this->msg( 'resetpass-wrong-oldpass' )->text() );
+               }
+
+               // User is resetting their password to their old password
+               if ( $oldpass === $newpass ) {
+                       throw new PasswordError( $this->msg( 'resetpass-recycled' )->text() );
+               }
+
+               // Do AbortChangePassword after checking mOldpass, so we don't leak information
+               // by possibly aborting a new password before verifying the old password.
                $abortMsg = 'resetpass-abort-generic';
                if ( !wfRunHooks( 'AbortChangePassword', array( $user, $oldpass, $newpass, &$abortMsg ) ) ) {
                        wfRunHooks( 'PrefsPasswordAudit', array( $user, $newpass, 'abortreset' ) );
                        throw new PasswordError( $this->msg( $abortMsg )->text() );
                }
 
-               if ( !$user->checkTemporaryPassword( $oldpass ) && !$user->checkPassword( $oldpass ) ) {
-                       wfRunHooks( 'PrefsPasswordAudit', array( $user, $newpass, 'wrongpassword' ) );
-                       throw new PasswordError( $this->msg( 'resetpass-wrong-oldpass' )->text() );
-               }
-
                // Please reset throttle for successful logins, thanks!
                if ( $throttleCount ) {
                        LoginForm::clearLoginThrottle( $this->mUserName );
@@ -240,7 +278,7 @@ class SpecialChangePassword extends FormSpecialPage {
                        // changing the password also modifies the user's token.
                        $user->setCookies();
                }
-
+               $user->resetPasswordExpiration();
                $user->saveSettings();
        }