better description of what happens when changing settings

darcs-hash:20080709050022-84dde-b8b583c8d2c67bcf6bbe86b2ff26eec7af345d72.gz

1 files changed, 15 insertions, 4 deletions

diff --git a/actions/login.php b/actions/login.php
index 5943464f7..ae75c9044 100644
--- a/actions/login.php
+++ b/actions/login.php
@@ -84,10 +84,21 @@ class LoginAction extends Action {
 	}
 
 	function get_instructions() {
-		return _t('Login with your username and password. ' .
-				  'Don\'t have a username yet? ' .
-				  '[Register](%%action.register%%) a new account, or ' .
-				  'try [OpenID](%%action.openidlogin%%). ');
+		if (common_logged_in() &&
+			!common_is_real_login() &&
+			common_get_returnto())
+		{
+			# rememberme logins have to reauthenticate before
+			# changing any profile settings (cookie-stealing protection)
+			return _t('To change your settings, login with your ' .
+					  'user name and password ' . 
+					  '(or use [OpenID](%%action.openidlogin%%)).');
+		} else {
+			return _t('Login with your username and password. ' .
+					  'Don\'t have a username yet? ' .
+					  '[Register](%%action.register%%) a new account, or ' .
+					  'try [OpenID](%%action.openidlogin%%). ');
+		}
 	}
 
 	function show_top($error=NULL) {