Thijs/wiki.techinc.nl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

* Accept null parameter to User::setPassword() as indicating the password

Browse source 
field should be cleared to an unusable state. Login will only be possible
  after the password is reset, for instance by e-mail.
* (bug 6394) Invalidate the password set for "by e-mail" account creations
  to avoid accidental empty password creations.
This commit is contained in:
Brion Vibber 2006-12-13 08:59:20 +00:00
parent 4bdff3636f
commit 295d0bf295
4 changed files with 32 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
RELEASE-NOTES
View file

@ -296,6 +296,11 @@ it from source control: http://www.mediawiki.org/wiki/Download_from_SVN
* (bug 8241) Don't consider user pages of User:Foo.css to be CSS subpages
* Set an explicit class on framed thumbnail inner divs and images, changed some
CSS to use these instead of using descendent selectors.
* Accept null parameter to User::setPassword() as indicating the password
field should be cleared to an unusable state. Login will only be possible
after the password is reset, for instance by e-mail.
* (bug 6394) Invalidate the password set for "by e-mail" account creations
to avoid accidental empty password creations.
== Languages updated ==

4
includes/AuthPlugin.php
View file

@ -146,6 +146,10 @@ class AuthPlugin {
/**
* Set the given password in the authentication database.
* As a special case, the password may be set to null to request
* locking the password to an unusable value, with the expectation
* that it will be set later through a mail reset or other method.
*
* Return true if successful.
*
* @param $user User object.

2
includes/SpecialUserlogin.php
View file

@ -123,6 +123,8 @@ class LoginForm {
return;
}
// Wipe the initial password and mail a temporary one
$u->setPassword( null );
$u->saveSettings();
$result = $this->mailPasswordInternal( $u, false );

30
includes/User.php
View file

@ -1303,20 +1303,26 @@ class User {
* pass the change through or if the legal password
* checks fail.
*
* As a special case, setting the password to null
* wipes it, so the account cannot be logged in until
* a new password is set, for instance via e-mail.
*
* @param string $str
* @throws PasswordError on failure
*/
function setPassword( $str ) {
global $wgAuth;
if( !$wgAuth->allowPasswordChange() ) {
throw new PasswordError( wfMsg( 'password-change-forbidden' ) );
}
if( $str !== null ) {
if( !$wgAuth->allowPasswordChange() ) {
throw new PasswordError( wfMsg( 'password-change-forbidden' ) );
}
if( !$this->isValidPassword( $str ) ) {
global $wgMinimalPasswordLength;
throw new PasswordError( wfMsg( 'passwordtooshort',
$wgMinimalPasswordLength ) );
if( !$this->isValidPassword( $str ) ) {
global $wgMinimalPasswordLength;
throw new PasswordError( wfMsg( 'passwordtooshort',
$wgMinimalPasswordLength ) );
}
}
if( !$wgAuth->setPassword( $this, $str ) ) {
@ -1325,9 +1331,15 @@ class User {
$this->load();
$this->setToken();
$this->mPassword = $this->encryptPassword( $str );
if( $str === null ) {
// Save an invalid hash...
$this->mPassword = '';
} else {
$this->mPassword = $this->encryptPassword( $str );
}
$this->mNewpassword = '';
$this->mNewpassTime = NULL;
$this->mNewpassTime = null;
return true;
}