allow less verbose operation of forget_password.php SC#282, backported from HEAD

admin/configvars.php

@@ -450,6 +450,9 @@ class configvarrss extends configvar {
     $security['notifyloginthreshold'] = new configvar (get_string('confignotifyloginthreshold', 'admin'),
         choose_from_menu($options, 'notifyloginthreshold', $config->notifyloginthreshold, '', '', '', true) );
 
+    $security['protectusernames'] = new configvar (get_string('configprotectusernames', 'admin'),
+        choose_from_menu($noyesoptions, 'protectusernames', $config->protectusernames, '', '', '', true) );
+
 /// secureforms
     $security['secureforms'] = new configvar (get_string('configsecureforms', 'admin'),
         choose_from_menu ($noyesoptions, 'secureforms', $config->secureforms, '', '', '', true) );

lang/en_utf8/admin.php

@@ -85,6 +85,7 @@ $string['configopentogoogle'] = 'If you enable this setting, then Google will be
 $string['configpathtoclam'] = 'Path to clam AV.  Probably something like /usr/bin/clamscan or /usr/bin/clamdscan. You need this in order for clam AV to run.';
 $string['configpathtodu'] = 'Path to du. Probably something like /usr/bin/du. If you enter this, pages that display directory contents will run much faster for directories with a lot of files.';
 $string['configperfdebug'] = 'If you turn this on, performance info will be printed in the footer of the standard theme';
+$string['configprotectusernames'] = 'By default forget_password.php does not display any hints that would allow guessing of usernames or email addresses.';
 $string['configproxyhost'] = 'If this <b>server</b> needs to use a proxy computer (eg a firewall) to access the Internet, then provide the proxy hostname and port here.  Otherwise leave it blank.';
 $string['configquarantinedir'] = 'If you want clam AV to move infected files to a quarantine directory, enter it here. It must be writable by the webserver.  If you leave this blank, or if you enter a directory that doesn\'t exit or isn\'t writable, infected files will be deleted.  Do not include a trailing slash.';
 $string['configrequestedteachername'] = 'Word for teacher used in requested courses';
@@ -130,6 +131,7 @@ $string['configzip'] = 'Indicate the location of your zip program (Unix only, op
 $string['confirmation'] = 'Confirmation';
 $string['confirminstall'] = 'You are about to install language pack ($a), are you sure?';
 $string['cronwarning'] = 'The <a href=\"cron.php\">cron.php maintenance script</a> has not been run for at least 24 hours.';
+$string['datarootsecuritywarning'] = 'Your site configuration might not be secure. Please make sure that your dataroot directory ($a) is not directly accessible via web.';
 $string['dbmigrate'] = 'Moodle Database Migration';
 $string['dbmigrationdeprecateddb'] = '<font color=\"#ff0000\">This database is migrated to a new UTF8 database and deprecated. Please edit your config.php and use the new database for this moodle.</font>';
 $string['dbmigrationdupfailed'] = 'Database duplication failed with possible error:<font color=\"#ff0000\"><pre>$a</pre></font>';

lang/en_utf8/moodle.php

@@ -395,6 +395,9 @@ line at the top of your web browser window.
 If you need help, please contact the site administrator,
 $a->admin';
 $string['emailconfirmationsubject'] = '$a: account confirmation';
+$string['emailpasswordconfirmmaybesent'] = '   <p>If you supplied correct username or address an email should have been sent to you.</p>
+   <p>It contains easy instructions to confirm and complete this password change.
+If you continue to have difficulty, please contact the site administrator.</p>';
 $string['emailconfirmsent'] = '   <p>An email should have been sent to your address at <b>$a</b></p>
    <p>It contains easy instructions to complete your registration.</p>
    <p>If you continue to have difficulty, contact the site administrator.</p>';

lib/defaults.php

@@ -77,6 +77,7 @@
        'pathtodu'                 => '',
        'prefix'                   => '',
        'perfdebug'                => 0,
+       'protectusernames'         => 1,       
        'proxyhost'                => '',
        'proxyport'                => '',
        'quarantinedir'            => '',

login/forgot_password.php

@@ -164,6 +164,12 @@ if ($param->action=='find' and confirm_sesskey()) {
     if (empty($param->username) and empty($param->email)) {
         $errors[] = 'no email or username';
     }
+
+    if ($page != 'external' and !empty($CFG->protectusernames)) {
+        // do not give any hints about usernames or email!
+        $errors = array();
+        $page = 'emailmaybeconfirmed';
+    }
 }
 
 // ACTION = AUTHENTICATE
@@ -204,15 +210,10 @@ if (!empty($param->p) and !empty($param->s)) {
 print_header( $txt->forgotten, $txt->forgotten,
     "<a href=\"{$CFG->wwwroot}/login/index.php\">{$txt->login}</a>->{$txt->forgotten}",
     'form.email' );
-print_simple_box_start('center');
 
-// display any errors
-if (count($errors)) {
-    echo "<ul class=\"errors\">\n";
-    foreach ($errors as $error) {
-        echo "    <li>$error</li>\n";
-    }
-    echo "</ul>\n";
+if ($page=='emailmaybeconfirmed') {
+    // Print general confirmation message
+    notice(get_string('emailpasswordconfirmmaybesent'),$CFG->wwwroot.'/index.php'); 
 }
 
 // check $page for appropriate page to display
@@ -244,6 +245,18 @@ elseif ($page=='duplicateemail') {
 }
 
 else {
+    echo '<br />';
+    print_simple_box_start('center','50%','','20');
+
+    // display any errors
+    if (count($errors)) {
+        echo "<ul class=\"errors\">\n";
+        foreach ($errors as $error) {
+            echo "    <li>$error</li>\n";
+        }
+        echo "</ul>\n";
+    }
+
 ?>
 
 <p><?php echo $txt->forgotteninstructions; ?></p>