diff --git a/admin/configvars.php b/admin/configvars.php index 25d8eb483e7..60aa0aeef6a 100644 --- a/admin/configvars.php +++ b/admin/configvars.php @@ -450,6 +450,9 @@ class configvarrss extends configvar { $security['notifyloginthreshold'] = new configvar (get_string('confignotifyloginthreshold', 'admin'), choose_from_menu($options, 'notifyloginthreshold', $config->notifyloginthreshold, '', '', '', true) ); + $security['protectusernames'] = new configvar (get_string('configprotectusernames', 'admin'), + choose_from_menu($noyesoptions, 'protectusernames', $config->protectusernames, '', '', '', true) ); + /// secureforms $security['secureforms'] = new configvar (get_string('configsecureforms', 'admin'), choose_from_menu ($noyesoptions, 'secureforms', $config->secureforms, '', '', '', true) ); diff --git a/lang/en_utf8/admin.php b/lang/en_utf8/admin.php index 80fc3afee21..25367fb76d0 100644 --- a/lang/en_utf8/admin.php +++ b/lang/en_utf8/admin.php @@ -85,6 +85,7 @@ $string['configopentogoogle'] = 'If you enable this setting, then Google will be $string['configpathtoclam'] = 'Path to clam AV. Probably something like /usr/bin/clamscan or /usr/bin/clamdscan. You need this in order for clam AV to run.'; $string['configpathtodu'] = 'Path to du. Probably something like /usr/bin/du. If you enter this, pages that display directory contents will run much faster for directories with a lot of files.'; $string['configperfdebug'] = 'If you turn this on, performance info will be printed in the footer of the standard theme'; +$string['configprotectusernames'] = 'By default forget_password.php does not display any hints that would allow guessing of usernames or email addresses.'; $string['configproxyhost'] = 'If this server needs to use a proxy computer (eg a firewall) to access the Internet, then provide the proxy hostname and port here. Otherwise leave it blank.'; $string['configquarantinedir'] = 'If you want clam AV to move infected files to a quarantine directory, enter it here. It must be writable by the webserver. If you leave this blank, or if you enter a directory that doesn\'t exit or isn\'t writable, infected files will be deleted. Do not include a trailing slash.'; $string['configrequestedteachername'] = 'Word for teacher used in requested courses'; @@ -130,6 +131,7 @@ $string['configzip'] = 'Indicate the location of your zip program (Unix only, op $string['confirmation'] = 'Confirmation'; $string['confirminstall'] = 'You are about to install language pack ($a), are you sure?'; $string['cronwarning'] = 'The cron.php maintenance script has not been run for at least 24 hours.'; +$string['datarootsecuritywarning'] = 'Your site configuration might not be secure. Please make sure that your dataroot directory ($a) is not directly accessible via web.'; $string['dbmigrate'] = 'Moodle Database Migration'; $string['dbmigrationdeprecateddb'] = 'This database is migrated to a new UTF8 database and deprecated. Please edit your config.php and use the new database for this moodle.'; $string['dbmigrationdupfailed'] = 'Database duplication failed with possible error:
$a
'; diff --git a/lang/en_utf8/moodle.php b/lang/en_utf8/moodle.php index f8a7f7db8ad..3c4b914a369 100644 --- a/lang/en_utf8/moodle.php +++ b/lang/en_utf8/moodle.php @@ -395,6 +395,9 @@ line at the top of your web browser window. If you need help, please contact the site administrator, $a->admin'; $string['emailconfirmationsubject'] = '$a: account confirmation'; +$string['emailpasswordconfirmmaybesent'] = '

If you supplied correct username or address an email should have been sent to you.

+

It contains easy instructions to confirm and complete this password change. +If you continue to have difficulty, please contact the site administrator.

'; $string['emailconfirmsent'] = '

An email should have been sent to your address at $a

It contains easy instructions to complete your registration.

If you continue to have difficulty, contact the site administrator.

'; diff --git a/lib/defaults.php b/lib/defaults.php index 0aa2b02ffd5..fe31572dad8 100644 --- a/lib/defaults.php +++ b/lib/defaults.php @@ -77,6 +77,7 @@ 'pathtodu' => '', 'prefix' => '', 'perfdebug' => 0, + 'protectusernames' => 1, 'proxyhost' => '', 'proxyport' => '', 'quarantinedir' => '', diff --git a/login/forgot_password.php b/login/forgot_password.php index 384726b9a44..7b20442955d 100644 --- a/login/forgot_password.php +++ b/login/forgot_password.php @@ -164,6 +164,12 @@ if ($param->action=='find' and confirm_sesskey()) { if (empty($param->username) and empty($param->email)) { $errors[] = 'no email or username'; } + + if ($page != 'external' and !empty($CFG->protectusernames)) { + // do not give any hints about usernames or email! + $errors = array(); + $page = 'emailmaybeconfirmed'; + } } // ACTION = AUTHENTICATE @@ -204,15 +210,10 @@ if (!empty($param->p) and !empty($param->s)) { print_header( $txt->forgotten, $txt->forgotten, "wwwroot}/login/index.php\">{$txt->login}->{$txt->forgotten}", 'form.email' ); -print_simple_box_start('center'); -// display any errors -if (count($errors)) { - echo "\n"; +if ($page=='emailmaybeconfirmed') { + // Print general confirmation message + notice(get_string('emailpasswordconfirmmaybesent'),$CFG->wwwroot.'/index.php'); } // check $page for appropriate page to display @@ -244,6 +245,18 @@ elseif ($page=='duplicateemail') { } else { + echo '
'; + print_simple_box_start('center','50%','','20'); + + // display any errors + if (count($errors)) { + echo "\n"; + } + ?>

forgotteninstructions; ?>