From fb5ed6a5ca05e10da7cbddfcc79bef2ccf70815d Mon Sep 17 00:00:00 2001
From: Brendan Heywood <brendan@catalyst-au.net>
Date: Tue, 22 Oct 2019 13:33:23 +1100
Subject: [PATCH] MDL-66984 auth: Allow $USER to be used in change_password_url

---
 lib/authlib.php | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/lib/authlib.php b/lib/authlib.php
index 4308a43d00c..7baa3b9c14a 100644
--- a/lib/authlib.php
+++ b/lib/authlib.php
@@ -766,6 +766,9 @@ class auth_plugin_base {
      * @return string[] An array of strings with keys subject and message
      */
     public function get_password_change_info(stdClass $user) : array {
+
+        global $USER;
+
         $site = get_site();
         $systemcontext = context_system::instance();
 
@@ -776,6 +779,10 @@ class auth_plugin_base {
         $data->sitename  = format_string($site->fullname);
         $data->admin     = generate_email_signoff();
 
+        // This is a workaround as change_password_url() is designed to allow
+        // use of the $USER global. See MDL-66984.
+        $olduser = $USER;
+        $USER = $user;
         if ($this->can_change_password() and $this->change_password_url()) {
             // We have some external url for password changing.
             $data->link = $this->change_password_url();
@@ -783,6 +790,7 @@ class auth_plugin_base {
             // No way to change password, sorry.
             $data->link = '';
         }
+        $USER = $olduser;
 
         if (!empty($data->link) and has_capability('moodle/user:changeownpassword', $systemcontext, $user->id)) {
             $subject = get_string('emailpasswordchangeinfosubject', '', format_string($site->fullname));