setHeaders(); $this->outputHeader(); $this->getOutput()->disallowUserJs(); $request = $this->getRequest(); $this->mUserName = trim( $request->getVal( 'wpName' ) ); $this->mOldpass = $request->getVal( 'wpPassword' ); $this->mNewpass = $request->getVal( 'wpNewPassword' ); $this->mRetype = $request->getVal( 'wpRetype' ); $this->mDomain = $request->getVal( 'wpDomain' ); $user = $this->getUser(); if ( !$user->isLoggedIn() && !LoginForm::getLoginToken() ) { LoginForm::setLoginToken(); } if ( !$request->wasPosted() && !$user->isLoggedIn() ) { $this->error( $this->msg( 'resetpass-no-info' )->text() ); return; } if ( $request->wasPosted() && $request->getBool( 'wpCancel' ) ) { $titleObj = Title::newFromText( $request->getVal( 'returnto' ) ); if ( !$titleObj instanceof Title ) { $titleObj = Title::newMainPage(); } $query = $request->getVal( 'returntoquery' ); $this->getOutput()->redirect( $titleObj->getFullURL( $query ) ); return; } $this->checkReadOnly(); $this->checkPermissions(); if ( $request->wasPosted() && $user->matchEditToken( $request->getVal( 'token' ) ) ) { try { $this->mDomain = $wgAuth->getDomain(); if ( !$wgAuth->allowPasswordChange() ) { $this->error( $this->msg( 'resetpass_forbidden' )->text() ); return; } if ( !$user->isLoggedIn() && $request->getVal( 'wpLoginOnChangeToken' ) !== LoginForm::getLoginToken() ) { // Potential CSRF (bug 62497) $this->error( $this->msg( 'sessionfailure' )->text() ); return false; } $this->attemptReset( $this->mNewpass, $this->mRetype ); if ( $user->isLoggedIn() ) { $this->getOutput()->wrapWikiMsg( "
\n$1\n
", 'changepassword-success' ); $this->getOutput()->returnToMain(); } else { LoginForm::setLoginToken(); $token = LoginForm::getLoginToken(); $data = array( 'action' => 'submitlogin', 'wpName' => $this->mUserName, 'wpDomain' => $this->mDomain, 'wpLoginToken' => $token, 'wpPassword' => $request->getVal( 'wpNewPassword' ), ) + $request->getValues( 'wpRemember', 'returnto', 'returntoquery' ); $login = new LoginForm( new DerivativeRequest( $request, $data, true ) ); $login->setContext( $this->getContext() ); $login->execute( null ); } return; } catch ( PasswordError $e ) { $this->error( $e->getMessage() ); } } $this->showForm(); } /** * @param $msg string */ function error( $msg ) { $this->getOutput()->addHTML( Xml::element( 'p', array( 'class' => 'error' ), $msg ) ); } function showForm() { global $wgCookieExpiration; $user = $this->getUser(); if ( !$this->mUserName ) { $this->mUserName = $user->getName(); } $rememberMe = ''; if ( !$user->isLoggedIn() ) { $rememberMe = '' . '' . '' . Xml::checkLabel( $this->msg( 'remembermypassword' )->numParams( ceil( $wgCookieExpiration / ( 3600 * 24 ) ) )->text(), 'wpRemember', 'wpRemember', $this->getRequest()->getCheck( 'wpRemember' ) ) . '' . ''; $submitMsg = 'resetpass_submit'; $oldpassMsg = 'resetpass-temp-password'; } else { $oldpassMsg = 'oldpassword'; $submitMsg = 'resetpass-submit-loggedin'; } $extraFields = array(); wfRunHooks( 'ChangePasswordForm', array( &$extraFields ) ); $prettyFields = array( array( 'wpName', 'username', 'text', $this->mUserName ), array( 'wpPassword', $oldpassMsg, 'password', $this->mOldpass ), array( 'wpNewPassword', 'newpassword', 'password', null ), array( 'wpRetype', 'retypenew', 'password', null ), ); $prettyFields = array_merge( $prettyFields, $extraFields ); $hiddenFields = array( 'token' => $user->getEditToken(), 'wpName' => $this->mUserName, 'wpDomain' => $this->mDomain, ) + $this->getRequest()->getValues( 'returnto', 'returntoquery' ); if ( !$user->isLoggedIn() ) { $hiddenFields['wpLoginOnChangeToken'] = LoginForm::getLoginToken(); } $hiddenFieldsStr = ''; foreach ( $hiddenFields as $fieldname => $fieldvalue ) { $hiddenFieldsStr .= Html::hidden( $fieldname, $fieldvalue ) . "\n"; } $this->getOutput()->addHTML( Xml::fieldset( $this->msg( 'resetpass_header' )->text() ) . Xml::openElement( 'form', array( 'method' => 'post', 'action' => $this->getTitle()->getLocalURL(), 'id' => 'mw-resetpass-form' ) ) . "\n" . $hiddenFieldsStr . $this->msg( 'resetpass_text' )->parseAsBlock() . "\n" . Xml::openElement( 'table', array( 'id' => 'mw-resetpass-table' ) ) . "\n" . $this->pretty( $prettyFields ) . "\n" . $rememberMe . "\n" . "\n" . '' . Xml::submitButton( $this->msg( $submitMsg )->text() ) . Xml::submitButton( $this->msg( 'resetpass-submit-cancel' )->text(), array( 'name' => 'wpCancel' ) ) . "\n" . "\n" . Xml::closeElement( 'table' ) . Xml::closeElement( 'form' ) . Xml::closeElement( 'fieldset' ) . "\n" ); } /** * @param $fields array * @return string */ function pretty( $fields ) { $out = ''; foreach ( $fields as $list ) { list( $name, $label, $type, $value ) = $list; if ( $type == 'text' ) { $field = htmlspecialchars( $value ); } else { $attribs = array( 'id' => $name ); if ( $name == 'wpNewPassword' || $name == 'wpRetype' ) { $attribs = array_merge( $attribs, User::passwordChangeInputAttribs() ); } if ( $name == 'wpPassword' ) { $attribs[] = 'autofocus'; } $field = Html::input( $name, $value, $type, $attribs ); } $out .= "\n"; $out .= "\t"; if ( $type != 'text' ) { $out .= Xml::label( $this->msg( $label )->text(), $name ); } else { $out .= $this->msg( $label )->escaped(); } $out .= "\n"; $out .= "\t"; $out .= $field; $out .= "\n"; $out .= ""; } return $out; } /** * @throws PasswordError when cannot set the new password because requirements not met. */ protected function attemptReset( $newpass, $retype ) { global $wgPasswordAttemptThrottle; $isSelf = ( $this->mUserName === $this->getUser()->getName() ); if ( $isSelf ) { $user = $this->getUser(); } else { $user = User::newFromName( $this->mUserName ); } if ( !$user || $user->isAnon() ) { throw new PasswordError( $this->msg( 'nosuchusershort', $this->mUserName )->text() ); } if ( $newpass !== $retype ) { wfRunHooks( 'PrefsPasswordAudit', array( $user, $newpass, 'badretype' ) ); throw new PasswordError( $this->msg( 'badretype' )->text() ); } $throttleCount = LoginForm::incLoginThrottle( $this->mUserName ); if ( $throttleCount === true ) { $lang = $this->getLanguage(); throw new PasswordError( $this->msg( 'login-throttled' ) ->params( $lang->formatDuration( $wgPasswordAttemptThrottle['seconds'] ) ) ->text() ); } $abortMsg = 'resetpass-abort-generic'; if ( !wfRunHooks( 'AbortChangePassword', array( $user, $this->mOldpass, $newpass, &$abortMsg ) ) ) { wfRunHooks( 'PrefsPasswordAudit', array( $user, $newpass, 'abortreset' ) ); throw new PasswordError( $this->msg( $abortMsg )->text() ); } if ( !$user->checkTemporaryPassword( $this->mOldpass ) && !$user->checkPassword( $this->mOldpass ) ) { wfRunHooks( 'PrefsPasswordAudit', array( $user, $newpass, 'wrongpassword' ) ); throw new PasswordError( $this->msg( 'resetpass-wrong-oldpass' )->text() ); } // Please reset throttle for successful logins, thanks! if ( $throttleCount ) { LoginForm::clearLoginThrottle( $this->mUserName ); } try { $user->setPassword( $this->mNewpass ); wfRunHooks( 'PrefsPasswordAudit', array( $user, $newpass, 'success' ) ); $this->mNewpass = $this->mOldpass = $this->mRetype = ''; } catch ( PasswordError $e ) { wfRunHooks( 'PrefsPasswordAudit', array( $user, $newpass, 'error' ) ); throw new PasswordError( $e->getMessage() ); } if ( $isSelf ) { // This is needed to keep the user connected since // changing the password also modifies the user's token. $user->setCookies(); } $user->saveSettings(); } protected function getGroupName() { return 'users'; } }