From 963cdce4e2586148972428cbbd343d3c58e8b8ff Mon Sep 17 00:00:00 2001
From: Ankit Agarwal <ankit@moodle.com>
Date: Thu, 21 Nov 2013 16:15:04 +0800
Subject: [PATCH] MDL-42097 auth: Auth plugins must check passwordurl before
 returning it

---
 auth/db/auth.php   | 2 +-
 auth/imap/auth.php | 6 +++++-
 auth/ldap/auth.php | 6 +++++-
 auth/pop3/auth.php | 6 +++++-
 auth/upgrade.txt   | 4 ++++
 lib/authlib.php    | 2 ++
 6 files changed, 22 insertions(+), 4 deletions(-)

diff --git a/auth/db/auth.php b/auth/db/auth.php
index 333142af3b2..d2087f71c88 100644
--- a/auth/db/auth.php
+++ b/auth/db/auth.php
@@ -664,7 +664,7 @@ class auth_plugin_db extends auth_plugin_base {
      * @return moodle_url
      */
     function change_password_url() {
-        if ($this->is_internal()) {
+        if ($this->is_internal() || empty($this->config->changepasswordurl)) {
             // Standard form.
             return null;
         } else {
diff --git a/auth/imap/auth.php b/auth/imap/auth.php
index 442f93e2488..ede7600eac8 100644
--- a/auth/imap/auth.php
+++ b/auth/imap/auth.php
@@ -120,7 +120,11 @@ class auth_plugin_imap extends auth_plugin_base {
      * @return moodle_url
      */
     function change_password_url() {
-        return new moodle_url($this->config->changepasswordurl);
+        if (!empty($this->config->changepasswordurl)) {
+            return new moodle_url($this->config->changepasswordurl);
+        } else {
+            return null;
+        }
     }
 
     /**
diff --git a/auth/ldap/auth.php b/auth/ldap/auth.php
index f92c08d01a9..a3fc3a84010 100644
--- a/auth/ldap/auth.php
+++ b/auth/ldap/auth.php
@@ -1603,7 +1603,11 @@ class auth_plugin_ldap extends auth_plugin_base {
      */
     function change_password_url() {
         if (empty($this->config->stdchangepassword)) {
-            return new moodle_url($this->config->changepasswordurl);
+            if (!empty($this->config->changepasswordurl)) {
+                return new moodle_url($this->config->changepasswordurl);
+            } else {
+                return null;
+            }
         } else {
             return null;
         }
diff --git a/auth/pop3/auth.php b/auth/pop3/auth.php
index 6b4bdff0844..5e25aa95bcf 100644
--- a/auth/pop3/auth.php
+++ b/auth/pop3/auth.php
@@ -120,7 +120,11 @@ class auth_plugin_pop3 extends auth_plugin_base {
      * @return moodle_url
      */
     function change_password_url() {
-        return new moodle_url($this->config->changepasswordurl);
+        if (!empty($this->config->changepasswordurl)) {
+            return new moodle_url($this->config->changepasswordurl);
+        } else {
+            return null;
+        }
     }
 
     /**
diff --git a/auth/upgrade.txt b/auth/upgrade.txt
index 6085397d9d8..8334fed703d 100644
--- a/auth/upgrade.txt
+++ b/auth/upgrade.txt
@@ -1,6 +1,10 @@
 This files describes API changes in /auth/* - plugins,
 information provided here is intended especially for developers.
 
+=== 2.7 ===
+
+* If you are returning a url in method change_password_url() from config, please make sure it is set before trying to use it.
+
 === 2.6 ===
 
 * can_be_manually_set() - This function was introduced in the base class and returns false by default. If overriden by
diff --git a/lib/authlib.php b/lib/authlib.php
index 736374214a2..3e0609377a9 100644
--- a/lib/authlib.php
+++ b/lib/authlib.php
@@ -159,6 +159,8 @@ class auth_plugin_base {
      *
      * This method is used if can_change_password() returns true.
      * This method is called only when user is logged in, it may use global $USER.
+     * If you are using a plugin config variable in this method, please make sure it is set before using it,
+     * as this method can be called even if the plugin is disabled, in which case the config values won't be set.
      *
      * @return moodle_url url of the profile page or null if standard used
      */