L-electron-Rare/moodle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

New version of forgot_password.php. Now correctly handles password change

Browse Source 
for the users 'actual' authentication type rather than whatever the
Moodle default happens to be.
User must now be found first so link in login screen is now just fixed.
This commit is contained in:
thepurpleblob
2005-09-22 14:52:56 +00:00
parent 541ff6ab16
commit 3605843255
3 changed files with 240 additions and 124 deletions
Download Patch File Download Diff File Expand all files Collapse all files
login/forgot_password.php
+235 -82
View File
@@ -1,109 +1,262 @@
<?php // $Id$
<?php // $Id
// forgot password routine.
// find the user and call the appropriate routine for their authentication
// type.
require_once("../config.php");
require_once('../config.php');
httpsrequired();
$p = optional_param('p','');
$s = optional_param('s','');
//HTTPS is potentially required in this page
httpsrequired();
//******************************
// GET PARAMS AND STRINGS
//******************************
if (!empty($p) and !empty($s)) { // User trying to authenticate change password routine
$param = new StdClass;
$param->action = optional_param( 'action','',PARAM_ALPHA );
$param->email = optional_param( 'email','',PARAM_CLEAN );
$param->p = optional_param( 'p','',PARAM_CLEAN );
$param->s = optional_param( 's','',PARAM_CLEAN );
$param->username = optional_param( 'username','',PARAM_CLEAN );
update_login_count();
$txt = new StdClass;
$txt->cancel = get_string('cancel');
$txt->confirmednot = get_string('confirmednot');
$txt->email = get_string('email');
$txt->emailnotfound = get_string('emailnotfound');
$txt->forgotten = get_string('passwordforgotten');
$txt->forgotteninstructions = get_string('passwordforgotteninstructions');
$txt->invalidemail = get_string('invalidemail');
$txt->login = get_string('login');
$txt->loginalready = get_string('loginalready');
$txt->ok = get_string('ok');
$txt->passwordextlink = get_string('passwordextlink');
$txt->passwordnohelp = get_string('passwordnohelp');
$txt->senddetails = get_string('senddetails');
$txt->username = get_string('username');
$txt->usernameemailmatch = get_string('usernameemailmatch');
$txt->usernamenotfound = get_string('usernamenotfound');
$user = get_complete_user_data("username", "$s");
$sesskey = sesskey();
$errors = array();
$page = ''; // page to display
if (!empty($user)) {
if ($user->secret == $p) { // They have provided the secret key to get in
if (isguest($user->id)) {
error("Can't change guest password!");
//******************************
// PROCESS ACTIONS
//******************************
// if you are logged in then you shouldn't be here!
if (isloggedin()) {
redirect( $CFG->wwwroot, $txt->loginalready, 5 );
}
// changepassword link replaced by individual auth setting
$auth = $CFG->auth; // the 'default' authentication method
if (!empty($CFG->changepassword)) {
if (empty($CFG->{'auth_'.$auth.'_changepasswordurl'})) {
set_config('auth_'.$auth.'_changepasswordurl',$CFG->changepassword );
}
set_config('changepassword','');
}
// ACTION = FIND
if ($param->action=='find' and confirm_sesskey()) {
// find the user in the database
// first try the username
if (!empty($param->username)) {
if (!$user=get_complete_user_data('username',$param->username)) {
$errors[] = $txt->usernamenotfound;
}
}
// now try email
if (!empty($param->email)) {
// validate email address 1st
if (!validate_email( $param->email )) {
$errors[] = $txt->invalidemail;
}
elseif (!$mailuser = get_complete_user_data('email',$param->email)) {
$errors[] = $txt->emailnotfound;
}
// just in case they did specify both...
// if $user exists then check they actually match (then just use $user)
if (!empty($user) and !empty($mailuser)) {
if ($user->id != $mailuser->id) {
$errors[] = $txt->usernameemailmatch;
}
$user = $mailuser;
}
// use email user if username not used or located
if (!empty($mailuser) and empty($user)) {
$user - $mailuser;
}
}
// if user located (and no errors) take the appropriate action
if (!empty($user) and (count($errors)==0)) {
// check this user isn't 'unconfirmed'
if (empty($user->confirmed)) {
$errors[] = $txt->confirmednot;
}
else {
// what to do depends on the authentication method
$authmethod = $user->auth;
if (is_internal_auth( $authmethod ) or !empty($CFG->{'auth_'.$authmethod.'_stdchangepassword'})) {
// handle internal authentication
// set 'secret' string
$user->secret = random_string( 15 );
if (!set_field('user','secret',$user->secret,'id',$user->id)) {
error( 'error setting user secret string' );
}
$user->emailstop = 0; // Send mail even if sending mail was forbidden
if (! reset_password_and_mail($user)) {
error("Could not reset password and mail the new one to you");
// send email (make sure mail block is off)
$user->mailstop = 0;
if (!send_password_change_confirmation_email($user)) {
error( 'error sending password change confirmation email' );
}
reset_login_count();
print_header(get_string("passwordsent"), get_string("passwordsent"), get_string("passwordsent"));
$a->email = $user->email;
$a->link = "$CFG->httpswwwroot/login/change_password.php";
notice(get_string("emailpasswordsent", "", $a), $a->link);
// display confirm message
$page = 'emailconfirm';
}
}
error(get_string("error"));
}
if ($frm = data_submitted()) { // Initial request for new password
if (!confirm_sesskey()) {
error( 'sesskey invalid' );
}
validate_form($frm, $err);
if (count((array)$err) == 0) {
if (!$user = get_complete_user_data("email", $frm->email)) {
error("No such user with this address: $frm->email");
else {
// handle some 'external' authentication
// if help text defined then we are going to display another page
$txt->extmessage = '';
$continue = false;
if (!empty( $CFG->{'auth_'.$authmethod.'_changepasswordhelp'} )) {
$txt->extmessage = $CFG->{'auth_'.$authmethod.'_changepasswordhelp'}.'<br /><br />';
}
// if url defined then add that to the message (with a standard message)
if (!empty( $CFG->{'auth_'.$authmethod.'_changepasswordurl'} )) {
$txt->extmessage .= $txt->passwordextlink . '<br /><br />';
$link = $CFG->{'auth_'.$authmethod.'_changepasswordurl'};
$txt->extmessage .= "<a href=\"$link\">$link</a>";
}
// if nothing to display, just do message that we can't help
if (empty($txt->extmessage)) {
$txt->extmessage = $txt->passwordextlink;
$continue = true;
}
$page = 'external';
}
if (empty($user->confirmed)) {
error(get_string("confirmednot"));
}
$user->secret = random_string(15);
if (!set_field("user", "secret", $user->secret, "id", $user->id)) {
error("Could not set user secret string!");
}
$user->emailstop = 0; // Send mail even if sending mail was forbidden
if (! send_password_change_confirmation_email($user)) {
error("Could not send you an email to confirm the password change");
}
print_header(get_string("passwordconfirmchange"), get_string("passwordconfirmchange"));
notice(get_string('emailpasswordconfirmsent', '', $user->email), "$CFG->wwwroot/");
}
}
if (empty($frm->email)) {
if ($username = get_moodle_cookie() ) {
$frm->email = get_field("user", "email", "username", "$username");
}
// nothing supplied - error
if (empty($param->username) and empty($param->email)) {
$errors[] = 'no email or username';
}
}
print_header(get_string("senddetails"), get_string("senddetails"),
"<a href=\"$CFG->wwwroot/login/index.php\">".get_string("login")."</a> -> ".get_string("senddetails"),
"form.email");
include("forgot_password_form.html");
print_footer();
// ACTION = AUTHENTICATE
if (!empty($param->p) and !empty($param->s)) {
update_login_count();
$user = get_complete_user_data('username',$s);
/******************************************************************************
* FUNCTIONS
*****************************************************************************/
// make sure that url relates to a valid user
if (!empty($user)) {
// check this isn't guest user
if (isguest( $user->id )) {
error('You cannot change the guest password');
}
function validate_form($frm, &$err) {
// override email stop and mail new password
$user->emailstop = 0;
if (!reset_password_and_mail($user)) {
error( 'Error resetting password and mailing you' );
}
if (empty($frm->email))
$err->email = get_string("missingemail");
else if (! validate_email($frm->email))
$err->email = get_string("invalidemail");
else if (! record_exists("user", "email", $frm->email))
$err->email = get_string("nosuchemail");
reset_login_count();
$page = 'emailsent';
$changepasswordurl = "{$CFG->httpswwwroot}/login/change_password.php";
$a->email = $user->email;
$a->link = $changepasswordurl;
$txt->emailpasswordsent = get_string( 'emailpasswordsent', '', $a );
}
}
//******************************
// DISPLAY PART
//******************************
print_header( $txt->forgotten, $txt->forgotten,
"<a href=\"{$CFG->wwwroot}/login/index.php\">{$txt->login}</a>->{$txt->forgotten}",
'form.email' );
print_simple_box_start('center');
// display any errors
if (count($errors)) {
echo "<ul class=\"errors\">\n";
foreach ($errors as $error) {
echo " <li>$error</li>\n";
}
echo "</ul>\n";
}
// check $page for appropriate page to display
if ($page=='emailconfirm') {
// Confirm (internal method) email sent
$txt->emailpasswordconfirmsent = get_string( 'emailpasswordconfirmsent','',$user->email );
notice( $txt->emailpasswordconfirmsent,"$CFG->wwwroot/" );
}
elseif ($page=='external') {
// display change password help text
print_simple_box( $txt->extmessage, 'center', '50%','','20','noticebox' );
// only print continue button if it makes sense
if ($continue) {
print_continue( "{$CFG->wwwroot}/" );
}
}
elseif ($page=='emailsent') {
// mail sent with new password
notice( $txt->emailpasswordsent, $changepasswordurl );
}
else {
?>
<p><?php echo $txt->forgotteninstructions; ?></p>
<form action="forgot_password.php" method="post">
<input type="hidden" name="sesskey" value="<?php echo $sesskey; ?>" />
<input type="hidden" name="action" value="find" />
<table id="forgottenpassword">
<tr>
<td><?php echo $txt->username; ?></td>
<td><input type="text" name="username" size="25" /></td>
</tr>
<tr>
<td><?php echo $txt->email; ?></td>
<td><input type="text" name="email" size="25" /></td>
</tr>
<tr>
<td>&nbsp;</td>
<td><input type="submit" value="<?php echo $txt->ok; ?>" />
<input type="button" value="<?php echo $txt->cancel; ?>"
onclick="javascript: history.go(-1)" /></td>
</tr>
</table>
</form>
<?php
}
print_simple_box_end();
print_footer();
?>
login/forgot_password_form.html
-29
View File
@@ -1,29 +0,0 @@
<table cellpadding="20" align="center" class="generalbox">
<tr valign="top">
<td width="300" valign="top">
<?php print_string("enteremailaddress") ?>
</td>
<td>
<form action="forgot_password.php" method="post" name="form" id="form">
<input type="hidden" name="sesskey" value="<?php echo sesskey(); ?>" />
<table>
<tr>
<td class="label"><?php print_string("email") ?>:</td>
<td><input type="text" name="email" size="25" value="<?php p($frm->email) ?>" alt="<?php print_string("email") ?>" />
<?php if (!empty($err->email)) {formerr($err->email);} ?>
</td>
</tr>
<tr>
<td></td>
<td><input type="submit" value="<?php print_string("ok") ?>" />
<input type="button" value="<?php print_string("cancel") ?>" onclick="javascript: history.go(-1)" />
</td>
</tr>
</table>
</form>
</td>
</tr>
</table>
login/index_form.html
+5 -13
View File
@@ -55,24 +55,16 @@
</form>
<?php } ?>
<?php if (!empty($CFG->{'auth_'.$CFG->auth.'_stdchangepassword'})
|| $CFG->changepassword
|| is_internal_auth() ) {
if (is_internal_auth() || !empty($CFG->{'auth_'.$CFG->auth.'_stdchangepassword'})) {
$changepassword = "forgot_password.php";
$changebuttonname = get_string("senddetails");
} else {
$changepassword = $CFG->changepassword;
$changebuttonname = get_string("passwordrecovery");
}
<?php
$changebuttonname = get_string("passwordrecovery");
$sesskey = sesskey();
?>
<hr width="80%" />
<p><?php print_string("forgotten") ?></p>
<form action="<?php p($changepassword) ?>" method="get" name="changepassword">
<form action="forgot_password.php" method="post" name="changepassword">
<input type="hidden" name="sesskey" value="<?php echo $sesskey; ?>" />
<input type="submit" value="<?php p($changebuttonname) ?>" />
</form>
<?php } ?>
</td>
<?php if ($show_instructions) { ?>