From 2f0dd8d5bd8022c707099e8bdd2d7340073e128b Mon Sep 17 00:00:00 2001 From: Peter Bulmer Date: Mon, 5 Aug 2013 14:14:55 +1200 Subject: [PATCH] MDL-23692 forgotpw: Coding style tidyups. --- admin/settings/security.php | 14 +-- lang/en/moodle.php | 6 +- lib/db/upgrade.php | 1 - login/forgot_password.php | 9 +- login/forgot_password_form.php | 27 ++++- login/index.php | 2 +- login/lib.php | 198 +++++++++++++++++++-------------- login/set_password_form.php | 40 +++++-- 8 files changed, 177 insertions(+), 120 deletions(-) diff --git a/admin/settings/security.php b/admin/settings/security.php index acb30489094..62712e37ea3 100644 --- a/admin/settings/security.php +++ b/admin/settings/security.php @@ -71,13 +71,13 @@ if ($hassiteconfig) { // speedup for non-admins, add all caps used on this page $temp->add(new admin_setting_configtext('minpasswordnonalphanum', new lang_string('minpasswordnonalphanum', 'admin'), new lang_string('configminpasswordnonalphanum', 'admin'), 1, PARAM_INT)); $temp->add(new admin_setting_configtext('maxconsecutiveidentchars', new lang_string('maxconsecutiveidentchars', 'admin'), new lang_string('configmaxconsecutiveidentchars', 'admin'), 0, PARAM_INT)); $pwresetoptions = array( - 300 => new lang_string('numminutes', '', 5), - 900 => new lang_string('numminutes', '', 15), - 1800 => new lang_string('numminutes', '', 30), - 2700 => new lang_string('numminutes', '', 45), - 3600 => new lang_string('numminutes', '', 60), - 7200 => new lang_string('numminutes', '', 120), - 14400 => new lang_string('numminutes', '', 240) + 300 => new lang_string('numminutes', '', 5), + 900 => new lang_string('numminutes', '', 15), + 1800 => new lang_string('numminutes', '', 30), + 2700 => new lang_string('numminutes', '', 45), + 3600 => new lang_string('numminutes', '', 60), + 7200 => new lang_string('numminutes', '', 120), + 14400 => new lang_string('numminutes', '', 240) ); $adminsetting = new admin_setting_configselect( 'pwresettime', diff --git a/lang/en/moodle.php b/lang/en/moodle.php index 691b3cc737b..dc16b7c733e 100644 --- a/lang/en/moodle.php +++ b/lang/en/moodle.php @@ -535,7 +535,7 @@ $string['editthisactivity'] = 'Edit this activity'; $string['editthiscategory'] = 'Edit this category'; $string['edituser'] = 'Edit user accounts'; $string['email'] = 'Email address'; -$string['emailalreadysent'] = 'A Password reset email has already been sent. Please check your email.'; +$string['emailalreadysent'] = 'A password reset email has already been sent. Please check your email.'; $string['emailactive'] = 'Email activated'; $string['emailagain'] = 'Email (again)'; $string['emailconfirm'] = 'Confirm your account'; @@ -1564,8 +1564,8 @@ $string['separateandconnectedinfo'] = 'The scale based on the theory of separate $string['servererror'] = 'An error occurred whilst communicating with the server'; $string['serverlocaltime'] = 'Server\'s local time'; $string['setcategorytheme'] = 'Set category theme'; -$string['setpassword'] = 'Set Password'; -$string['setpasswordinstructions'] = 'Please enter and repeat your new password below, then click "Set Password".
Your new password will be saved, and you will be logged in.'; +$string['setpassword'] = 'Set password'; +$string['setpasswordinstructions'] = 'Please enter and repeat your new password below, then click "Set password".
Your new password will be saved, and you will be logged in.'; $string['settings'] = 'Settings'; $string['shortname'] = 'Short name'; // @deprecated MDL-34652 - use shortnamecourse or shortnameuser or some own context specific string $string['shortnamecollisionwarning'] = '[*] = This shortname is already in use by a course and will need to be changed upon approval'; diff --git a/lib/db/upgrade.php b/lib/db/upgrade.php index f9de797f520..f8885d4415a 100644 --- a/lib/db/upgrade.php +++ b/lib/db/upgrade.php @@ -2575,6 +2575,5 @@ function xmldb_main_upgrade($oldversion) { upgrade_main_savepoint(true, 2013092700.02); } - return true; } diff --git a/login/forgot_password.php b/login/forgot_password.php index e00906e0e61..883eb98c5c3 100644 --- a/login/forgot_password.php +++ b/login/forgot_password.php @@ -1,5 +1,4 @@ loginhttps enabled $PAGE->https_required(); @@ -62,10 +61,10 @@ if (isloggedin() and !isguestuser()) { if (empty($token)) { // This is a new password reset request. - // Process the request; identify the user & send confirmation email: - forgotpw_process_request(); + // Process the request; identify the user & send confirmation email. + core_login_process_password_reset_request(); } else { // User clicked on confirmation link in email message // validate the token & set new password - forgotpw_process_pwset($token); + core_login_process_password_set($token); } diff --git a/login/forgot_password_form.php b/login/forgot_password_form.php index 997dcd553cd..84272c115ad 100644 --- a/login/forgot_password_form.php +++ b/login/forgot_password_form.php @@ -1,5 +1,4 @@ . +/** + * Forgot password page. + * + * @package core + * @subpackage auth + * @copyright 1999 onwards Martin Dougiamas http://dougiamas.com + * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later + */ +defined('MOODLE_INTERNAL') || die(); + +require_once($CFG->libdir.'/formslib.php'); + /** * Reset forgotten password form definition. * @@ -23,13 +34,11 @@ * @copyright 2006 Petr Skoda {@link http://skodak.org} * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later */ - -defined('MOODLE_INTERNAL') || die(); - -require_once $CFG->libdir.'/formslib.php'; - class login_forgot_password_form extends moodleform { + /** + * Define the forgot password form. + */ function definition() { $mform = $this->_form; $mform->setDisableShortforms(true); @@ -51,6 +60,12 @@ class login_forgot_password_form extends moodleform { $mform->addElement('submit', 'submitbuttonemail', $submitlabel); } + /** + * Validate user input from the forgot password form. + * @param array $data array of submitted form fields. + * @param array $files submitted with the form. + * @return array errors occuring during validation. + */ function validation($data, $files) { global $CFG, $DB; diff --git a/login/index.php b/login/index.php index def89e973f7..a4e29fc9456 100644 --- a/login/index.php +++ b/login/index.php @@ -194,7 +194,7 @@ if ($frm and isset($frm->username)) { // Login WITH set_moodle_cookie($USER->username); } - $urltogo = get_postlogin_redirection(); + $urltogo = core_login_get_return_url(); /// check if user password has expired /// Currently supported only for ldap-authentication module diff --git a/login/lib.php b/login/lib.php index eaa5595485d..ab1ef1f83c2 100644 --- a/login/lib.php +++ b/login/lib.php @@ -1,14 +1,40 @@ . + +/** + * + * Login library file of login/password related Moodle functions. + * + * @package core + * @subpackage lib + * @copyright Catalyst IT + * @copyright Peter Bulmer + * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later + */ define('PWRESET_STATUS_NOEMAILSENT', 1); define('PWRESET_STATUS_TOKENSENT', 2); define('PWRESET_STATUS_OTHEREMAILSENT', 3); define('PWRESET_STATUS_ALREADYSENT', 4); -/* This function processes a user's request to set a new password in the event they forgot the old one. - If no user identifier has been supplied, it displays a form where they can submit their identifier. - Where they have supplied identifier, the function will check their status, and send email as appropriate. -*/ -function forgotpw_process_request() { +/** + * Processes a user's request to set a new password in the event they forgot the old one. + * If no user identifier has been supplied, it displays a form where they can submit their identifier. + * Where they have supplied identifier, the function will check their status, and send email as appropriate. + */ +function core_login_process_password_reset_request() { global $DB, $OUTPUT, $CFG, $PAGE; $systemcontext = context_system::instance(); $mform = new login_forgot_password_form(); @@ -18,25 +44,26 @@ function forgotpw_process_request() { } else if ($data = $mform->get_data()) { // Requesting user has submitted form data. - // Find the user account in the database which the requesting user claims to own: + // Next find the user account in the database which the requesting user claims to own. if (!empty($data->username)) { // Username has been specified - load the user record based on that. - $username = core_text::strtolower($data->username); // mimic the login page process, if they forget username they need to use email for reset - $user = $DB->get_record('user', array('username'=>$username, 'mnethostid'=>$CFG->mnet_localhost_id, 'deleted'=>0, 'suspended'=>0)); - + $username = core_text::strtolower($data->username); // Mimic the login page process. + $userparams = array('username' => $username, 'mnethostid' => $CFG->mnet_localhost_id, 'deleted' => 0, 'suspended' => 0); + $user = $DB->get_record('user', $userparams); } else { - // Try to load the user record based on email address: + // Try to load the user record based on email address. // this is tricky because - // 1/ the email is not guaranteed to be unique - TODO: send email with all usernames to select the correct account for pw reset - // 2/ mailbox may be case sensitive, the email domain is case insensitive - let's pretend it is all case-insensitive + // 1/ the email is not guaranteed to be unique - TODO: send email with all usernames to select the account for pw reset + // 2/ mailbox may be case sensitive, the email domain is case insensitive - let's pretend it is all case-insensitive. - $select = $DB->sql_like('email', ':email', false, true, false, '|'). " AND mnethostid = :mnethostid AND deleted=0 AND suspended=0"; - $params = array('email'=>$DB->sql_like_escape($data->email, '|'), 'mnethostid'=>$CFG->mnet_localhost_id); + $select = $DB->sql_like('email', ':email', false, true, false, '|') . + " AND mnethostid = :mnethostid AND deleted=0 AND suspended=0"; + $params = array('email' => $DB->sql_like_escape($data->email, '|'), 'mnethostid' => $CFG->mnet_localhost_id); $user = $DB->get_record_select('user', $select, $params, '*', IGNORE_MULTIPLE); } // Target user details have now been identified, or we know that there is no such account. - // Send email address to account's email address if appropriate: + // Send email address to account's email address if appropriate. $pwresetstatus = PWRESET_STATUS_NOEMAILSENT; if ($user and !empty($user->confirmed)) { $userauth = get_auth_plugin($user->auth); @@ -49,20 +76,20 @@ function forgotpw_process_request() { } } else { // The account the requesting user claims to be is entitled to change their password. - // Check if they have an existing password reset in progress: + // Next, check if they have an existing password reset in progress. $resetinprogress = $DB->get_record('user_password_resets', array('userid' => $user->id)); if (empty($resetinprogress)) { - // Completely new reset request - common case - $resetrecord = create_reset_record($user); + // Completely new reset request - common case. + $resetrecord = core_login_generate_password_reset($user); $sendemail = true; - } elseif ($resetinprogress->timerequested < (time() - $CFG->pwresettime)) { + } else if ($resetinprogress->timerequested < (time() - $CFG->pwresettime)) { // Preexisting, but expired request - delete old record & create new one. // Uncommon case - expired requests are cleaned up by cron. $DB->delete_records('user_password_resets', array('id' => $resetinprogress->id)); - $resetrecord = create_reset_record($user); + $resetrecord = core_login_generate_password_reset($user); $sendemail = true; - } elseif (empty($resetinprogress->timererequested)) { - // Preexisting, valid request. This is the first time user has re-requested the reset + } else if (empty($resetinprogress->timererequested)) { + // Preexisting, valid request. This is the first time user has re-requested the reset. // Re-sending the same email once can actually help in certain circumstances // eg by reducing the delay caused by greylisting. $resetinprogress->timererequested = time(); @@ -87,53 +114,53 @@ function forgotpw_process_request() { } // Any email has now been sent. - // Display results to requesting user if settings permit: + // Next display results to requesting user if settings permit. echo $OUTPUT->header(); if (!empty($CFG->protectusernames)) { // Neither confirm, nor deny existance of any username or email address in database. - // Print general (non-commital) message + // Print general (non-commital) message. notice(get_string('emailpasswordconfirmmaybesent'), $CFG->wwwroot.'/index.php'); - die; // never reached - } elseif (empty($user)) { + die; // Never reached. + } else if (empty($user)) { // Protect usernames is off, and we couldn't find the user with details specified. - // Print failure advice: + // Print failure advice. notice(get_string('emailpasswordconfirmnotsent'), $CFG->wwwroot.'/forgot_password.php'); - die; // never reached - } elseif (empty($user->email)) { + die; // Never reached. + } else if (empty($user->email)) { // User doesn't have an email set - can't send a password change confimation email. notice(get_string('emailpasswordconfirmnoemail'), $CFG->wwwroot.'/index.php'); - die; // never reached. + die; // Never reached. } else if ($pwresetstatus == PWRESET_STATUS_ALREADYSENT) { // User found, protectusernames is off, but user has already (re) requested a reset. // Don't send a 3rd reset email. $stremailalreadysent = get_string('emailalreadysent'); notice($stremailalreadysent, $CFG->wwwroot.'/index.php'); - die; // never reached - } elseif ($pwresetstatus == PWRESET_STATUS_NOEMAILSENT) { - // User found, protectusernames is off, but user is not confirmed - // Pretend we sent them an email - // This is a big usability problem - need to tell users why we didn't send them an email - $protectedemail = preg_replace('/([^@]*)@(.*)/', '******@$2', $user->email); // obfuscate the email address to protect privacy + die; // Never reached. + } else if ($pwresetstatus == PWRESET_STATUS_NOEMAILSENT) { + // User found, protectusernames is off, but user is not confirmed. + // Pretend we sent them an email. + // This is a big usability problem - need to tell users why we didn't send them an email. + // Obfuscate email address to protect privacy. + $protectedemail = preg_replace('/([^@]*)@(.*)/', '******@$2', $user->email); $stremailpasswordconfirmsent = get_string('emailpasswordconfirmsent', '', $protectedemail); notice($stremailpasswordconfirmsent, $CFG->wwwroot.'/index.php'); - die; // never reached + die; // Never reached. } else { - // Confirm email sent - $protectedemail = preg_replace('/([^@]*)@(.*)/', '******@$2', $user->email); // obfuscate the email address to protect privacy + // Confirm email sent. (Obfuscate email address to protect privacy). + $protectedemail = preg_replace('/([^@]*)@(.*)/', '******@$2', $user->email); // This is a small usability problem - may be obfuscating the email address which the user has just supplied. $stremailresetconfirmsent = get_string('emailresetconfirmsent', '', $protectedemail); notice($stremailresetconfirmsent, $CFG->wwwroot.'/index.php'); - die; // never reached + die; // Never reached. } - die; // never reached + die; // Never reached. } - // make sure we really are on the https page when https login required + // Make sure we really are on the https page when https login required. $PAGE->verify_https_required(); - - /// DISPLAY FORM + // DISPLAY FORM. echo $OUTPUT->header(); echo $OUTPUT->box(get_string('passwordforgotteninstructions2'), 'generalbox boxwidthnormal boxaligncenter'); @@ -142,45 +169,46 @@ function forgotpw_process_request() { echo $OUTPUT->footer(); } -/* This function processes a user's submitted token to validate the request to set a new password - If the user's token is validated, they are prompted to set a new password. - * @param string $token the one-use identifier which should verify the password reset request as being valid -*/ -function forgotpw_process_pwset($token) { +/** This function processes a user's submitted token to validate the request to set a new password. + * If the user's token is validated, they are prompted to set a new password. + * @param string $token the one-use identifier which should verify the password reset request as being valid. + * @return null + */ +function core_login_process_password_set($token) { global $DB, $CFG, $OUTPUT, $PAGE, $SESSION; - $systemcontext = context_system::instance(); $pwresettime = isset($CFG->pwresettime) ? $CFG->pwresettime : 1800; - $sql = 'SELECT u.*, upr.token, upr.timerequested, upr.id as tokenid FROM ' . $CFG->prefix . 'user u' . - ' INNER JOIN ' . $CFG->prefix . 'user_password_resets upr ON upr.userid = u.id ' . - 'WHERE upr.token = ?'; + $sql = "SELECT u.*, upr.token, upr.timerequested, upr.id as tokenid + FROM {user} u + JOIN {user_password_resets} upr ON upr.userid = u.id + WHERE upr.token = ?"; $user = $DB->get_record_sql($sql, array($token)); $forgotpasswordurl = "{$CFG->httpswwwroot}/login/forgot_password.php"; if (empty($user) or ($user->timerequested < (time() - $pwresettime - DAYSECS))) { // There is no valid reset request record - not even a recently expired one. // (suspicious) - // Direct the user to the forgot password page to request a password reset + // Direct the user to the forgot password page to request a password reset. echo $OUTPUT->header(); notice(get_string('noresetrecord'), $forgotpasswordurl); - die; // never reached + die; // Never reached. } if ($user->timerequested < (time() - $pwresettime)) { - // There is a reset record, but it's expired - // Direct the user to the forgot password page to request a password reset + // There is a reset record, but it's expired. + // Direct the user to the forgot password page to request a password reset. $pwresetmins = floor($pwresettime / MINSECS); echo $OUTPUT->header(); notice(get_string('resetrecordexpired', '', $pwresetmins), $forgotpasswordurl); - die; // never reached + die; // Never reached. } if ($user->auth === 'nologin' or !is_enabled_auth($user->auth)) { - // bad luck - user is not able to login, do not let them set password + // Bad luck - user is not able to login, do not let them set password. echo $OUTPUT->header(); print_error('forgotteninvalidurl'); - die; // never reached + die; // Never reached. } - // check this isn't guest user + // Check this isn't guest user. if (isguestuser($user)) { print_error('cannotresetguestpwd'); } @@ -190,7 +218,7 @@ function forgotpw_process_pwset($token) { $data = $mform->get_data(); if (empty($data)) { // User hasn't submitted form, they got here directly from email link. - // Display the form: + // Next, display the form. $setdata = new stdClass(); $setdata->username = $user->username; $setdata->username2 = $user->username; @@ -204,38 +232,37 @@ function forgotpw_process_pwset($token) { return; } else { // User has submitted form. - // Delete this token so it can't be used again: + // Delete this token so it can't be used again. $DB->delete_records('user_password_resets', array('id' => $user->tokenid)); $userauth = get_auth_plugin($user->auth); if (!$userauth->user_update_password($user, $data->password)) { print_error('errorpasswordupdate', 'auth'); } add_to_log(SITEID, 'user', 'set password', "view.php?id=$user->id&course=" . SITEID, $user->id); - // Reset login lockout (if present) before a new password is set: + // Reset login lockout (if present) before a new password is set. login_unlock_account($user); - // Clear any requirement to change passwords + // Clear any requirement to change passwords. unset_user_preference('auth_forcepasswordchange', $user); unset_user_preference('create_password', $user); if (!empty($user->lang)) { - // unset previous session language - use user preference instead + // Unset previous session language - use user preference instead. unset($SESSION->lang); } add_to_log(SITEID, 'user', 'login', "view.php?id=$user->id&course=".SITEID, $user->id, 0, $user->id); complete_user_login($user); - $urltogo = get_postlogin_redirection(); + $urltogo = core_login_get_return_url(); unset($SESSION->wantsurl); redirect($urltogo, get_string('passwordset'), 1); } } -/* - * Create a new record in the database to track a new password set request for user +/** Create a new record in the database to track a new password set request for user. * @param object $user the user record, the requester would like a new password set for. - * @return record created -*/ -function create_reset_record ($user) { - global $CFG, $DB; + * @return record created. + */ +function core_login_generate_password_reset ($user) { + global $DB; $resetrecord = new stdClass(); $resetrecord->timerequested = time(); $resetrecord->userid = $user->id; @@ -244,29 +271,31 @@ function create_reset_record ($user) { return $resetrecord; } -/* Determine where a user should be redirected after they have been logged in -*/ -function get_postlogin_redirection() { +/** Determine where a user should be redirected after they have been logged in. + * @return string url the user should be redirected to. + */ +function core_login_get_return_url() { global $CFG, $SESSION, $USER; - /// Prepare redirection + // Prepare redirection. if (user_not_fully_set_up($USER)) { $urltogo = $CFG->wwwroot.'/user/edit.php'; - // We don't delete $SESSION->wantsurl yet, so we get there later + // We don't delete $SESSION->wantsurl yet, so we get there later. - } else if (isset($SESSION->wantsurl) and (strpos($SESSION->wantsurl, $CFG->wwwroot) === 0 or strpos($SESSION->wantsurl, str_replace('http://', 'https://', $CFG->wwwroot)) === 0)) { - $urltogo = $SESSION->wantsurl; /// Because it's an address in this site + } else if (isset($SESSION->wantsurl) and (strpos($SESSION->wantsurl, $CFG->wwwroot) === 0 + or strpos($SESSION->wantsurl, str_replace('http://', 'https://', $CFG->wwwroot)) === 0)) { + $urltogo = $SESSION->wantsurl; // Because it's an address in this site. unset($SESSION->wantsurl); } else { - // no wantsurl stored or external - go to homepage + // No wantsurl stored or external - go to homepage. $urltogo = $CFG->wwwroot.'/'; unset($SESSION->wantsurl); } // If the url to go to is the same as the site page, check for default homepage. if ($urltogo == ($CFG->wwwroot . '/')) { - $home_page = get_home_page(); - // Go to my-moodle page instead of site homepage if defaulthomepage set to homepage_my - if ($home_page == HOMEPAGE_MY && !is_siteadmin() && !isguestuser()) { + $homepage = get_home_page(); + // Go to my-moodle page instead of site homepage if defaulthomepage set to homepage_my. + if ($homepage == HOMEPAGE_MY && !is_siteadmin() && !isguestuser()) { if ($urltogo == $CFG->wwwroot or $urltogo == $CFG->wwwroot.'/' or $urltogo == $CFG->wwwroot.'/index.php') { $urltogo = $CFG->wwwroot.'/my/'; } @@ -274,4 +303,3 @@ function get_postlogin_redirection() { } return $urltogo; } -?> diff --git a/login/set_password_form.php b/login/set_password_form.php index e68f0941aab..8cfb6ab6eea 100644 --- a/login/set_password_form.php +++ b/login/set_password_form.php @@ -25,11 +25,23 @@ defined('MOODLE_INTERNAL') || die(); -require_once $CFG->libdir.'/formslib.php'; +require_once($CFG->libdir.'/formslib.php'); +/** + * Set forgotten password form definition. + * + * @package core + * @subpackage auth + * @copyright 2006 Petr Skoda {@link http://skodak.org} + * @copyright 2013 Peter Bulmer + * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later + */ class login_set_password_form extends moodleform { - function definition() { + /** + * Define the set password form. + */ + public function definition() { global $USER, $CFG; $mform = $this->_form; @@ -37,44 +49,48 @@ class login_set_password_form extends moodleform { $mform->addElement('header', 'setpassword', get_string('setpassword'), ''); // Include the username in the form so browsers will recognise that a password is being set. - $mform->addElement('text', 'username','','style="display: none;" autocomplete="on"'); + $mform->addElement('text', 'username', '', 'style="display: none;" autocomplete="on"'); $mform->setType('username', PARAM_RAW); // Token gives authority to change password. $mform->addElement('hidden', 'token', ''); $mform->setType('token', PARAM_ALPHANUM); - // visible elements + // Visible elements. $mform->addElement('static', 'username2', get_string('username')); - if (!empty($CFG->passwordpolicy)){ + if (!empty($CFG->passwordpolicy)) { $mform->addElement('static', 'passwordpolicyinfo', '', print_password_policy()); } $mform->addElement('password', 'password', get_string('newpassword'), 'autocomplete="on"'); $mform->addRule('password', get_string('required'), 'required', null, 'client'); $mform->setType('password', PARAM_RAW); - $mform->addElement('password', 'password2', get_string('newpassword').' ('.get_String('again').')', 'autocomplete="on"'); + $strpasswordagain = get_string('newpassword') . ' (' . get_string('again') . ')'; + $mform->addElement('password', 'password2', $strpasswordagain, 'autocomplete="on"'); $mform->addRule('password2', get_string('required'), 'required', null, 'client'); $mform->setType('password2', PARAM_RAW); - // buttons $this->add_action_buttons(true); } - // perform extra password change validation - function validation($data, $files) { + /** + * Perform extra password change validation. + * @param array $data submitted form fields. + * @param array $files submitted with the form. + * @return array errors occuring during validation. + */ + public function validation($data, $files) { global $USER; $errors = parent::validation($data, $files); // Ignore submitted username. - // TODO: Validate submitted token. - if ($data['password'] <> $data['password2']) { + if ($data['password'] !== $data['password2']) { $errors['password'] = get_string('passwordsdiffer'); $errors['password2'] = get_string('passwordsdiffer'); return $errors; } - $errmsg = '';//prevents eclipse warnings + $errmsg = ''; // Prevents eclipse warnings. if (!check_password_policy($data['password'], $errmsg)) { $errors['password'] = $errmsg; $errors['password2'] = $errmsg;