MDL-9429 make clear that alternate change password url is used only when user is logged in, for example change url may contain $USER->username; other minor cleanup

lib/authlib.php

@@ -87,6 +87,7 @@ class auth_plugin_base {
     /**
      * Returns the URL for changing the users' passwords, or empty if the default
      * URL can be used. This method is used if can_change_password() returns true.
+     * This method is called only when user is logged in, it may use global $USER.
      *
      * @return string
      */

lib/moodlelib.php

@@ -1665,9 +1665,9 @@ function require_login($courseorid=0, $autologinguest=true, $cm=null) {
     if (get_user_preferences('auth_forcepasswordchange') && empty($USER->realuser)) {
         if ($userauth->can_change_password()) {
             $SESSION->wantsurl = $FULLME;
-            if ($userauth->change_password_url()) {
+            if ($changeurl = $userauth->change_password_url()) {
                 //use plugin custom url
-                redirect($userauth->change_password_url());
+                redirect($changeurl);
             } else {
                 //use moodle internal method
                 if (empty($CFG->loginhttps)) {

login/change_password.php

@@ -43,9 +43,9 @@
         error(get_string('nopasswordchange', 'auth'));
     }
 
-    if ($userauth->change_password_url()) {
+    if ($changeurl = $userauth->change_password_url()) {
         // this internal scrip not used
-        redirect($userauth->change_password_url());
+        redirect($changeurl);
     }
 
     $mform = new login_change_password_form();

login/index.php

@@ -25,6 +25,7 @@
 
 /// Check if the guest user exists.  If not, create one.
     if (! record_exists('user', 'username', 'guest')) {
+        $guest = new object();
         $guest->auth        = 'manual'; 
         $guest->username    = 'guest'; 
         $guest->password    = hash_internal_user_password('guest');
@@ -177,25 +178,19 @@ httpsrequired();
 
             /// This is what lets the user do anything on the site :-)
             load_all_capabilities();
-
-            //Select password change url
             $userauth = get_auth_plugin($USER->auth);
-            if ($userauth->can_change_password()) {
-                if ($userauth->change_password_url()) {
-                    $passwordchangeurl = $userauth->change_password_url();
-                } else {
-                    $passwordchangeurl = $CFG->httpswwwroot.'/login/change_password.php';
-                }
-            } else {
-                $passwordchangeurl = '';
-            }
 
             // check whether the user should be changing password
             if (get_user_preferences('auth_forcepasswordchange', false) || $frm->password == 'changeme'){
-                if ($passwordchangeurl != '') {
-                    redirect($passwordchangeurl);
+                //Select password change url
+                if ($userauth->can_change_password()) {
+                    if ($changeurl = $userauth->change_password_url()) {
+                        redirect($changeurl);
+                    } else {
+                        redirect($CFG->httpswwwroot.'/login/change_password.php');
+                    }
                 } else {
-                    error(get_strin('nopasswordchangeforced', 'auth'));
+                    error(get_string('nopasswordchangeforced', 'auth'));
                 }
             }
 

user/view.php

@@ -356,7 +356,7 @@
     $userauth = get_auth_plugin($user->auth);
 
     $passwordchangeurl = false;
-    if ($userauth->can_change_password()) {
+    if ($currentuser and $userauth->can_change_password() and !isguest()) { //TODO: add proper capability for password changing
         if ($userauth->change_password_url()) {
             $passwordchangeurl = $userauth->change_password_url();
         } else {
@@ -371,7 +371,10 @@
 //  Print other functions
     echo '<div class="buttons">';
 
-    if ($currentuser and $passwordchangeurl and !isguest()) { //TODO: add proper capability for password changing
+    if ($passwordchangeurl) {
+        if (!empty($USER->realuser)) {
+            $passwordchangeurl = ''; // do not use actual change password url - might contain sensitive data
+        }
         echo "<form action=\"$passwordchangeurl\" method=\"get\">";
         echo "<div>";
         echo "<input type=\"hidden\" name=\"id\" value=\"$course->id\" />";