X-Git-Url: https://git.heureux-cyclage.org/?a=blobdiff_plain;f=includes%2Fuser%2FPasswordReset.php;h=ef104cce5c1e7120e50de4787359c4670956c86d;hb=98c6b642074bc4f0a3cb9f653e2dd83606582730;hp=e7825e423920badf287ae71760531d055b95933d;hpb=0ada062ce62a261e55eb2bfbe9c6f74ffbaa05e5;p=lhc%2Fweb%2Fwiklou.git

diff --git a/includes/user/PasswordReset.php b/includes/user/PasswordReset.php
index e7825e4239..ef104cce5c 100644
--- a/includes/user/PasswordReset.php
+++ b/includes/user/PasswordReset.php
@@ -46,14 +46,14 @@ class PasswordReset implements LoggerAwareInterface {
 	/**
 	 * In-process cache for isAllowed lookups, by username.
 	 * Contains a StatusValue object
-	 * @var HashBagOStuff
+	 * @var MapCacheLRU
 	 */
 	private $permissionCache;
 
 	public function __construct( Config $config, AuthManager $authManager ) {
 		$this->config = $config;
 		$this->authManager = $authManager;
-		$this->permissionCache = new HashBagOStuff( [ 'maxKeys' => 1 ] );
+		$this->permissionCache = new MapCacheLRU( 1 );
 		$this->logger = LoggerFactory::getInstance( 'authentication' );
 	}
 
@@ -240,7 +240,9 @@ class PasswordReset implements LoggerAwareInterface {
 
 		$passwords = [];
 		foreach ( $reqs as $req ) {
-			$this->authManager->changeAuthenticationData( $req );
+			// This is adding a new temporary password, not intentionally changing anything
+			// (even though it might technically invalidate an old temporary password).
+			$this->authManager->changeAuthenticationData( $req, /* $isAddition */ true );
 		}
 
 		$this->logger->info(
@@ -268,7 +270,7 @@ class PasswordReset implements LoggerAwareInterface {
 			// Normal block. Maybe it was meant for someone else and the user just needs to log in;
 			// or maybe it was issued specifically to prevent some IP from messing with password
 			// reset? Go out on a limb and use the registration allowed flag to decide.
-			return $block->prevents( 'createaccount' );
+			return $block->isCreateAccountBlocked();
 		} elseif ( $type === 'proxy' ) {
 			// we disallow actions through proxy even if the user is logged in
 			// so it makes sense to disallow password resets as well