Besides adding the is_guest() check in the check_password_policy() condition,
I also changed the temporary user ID because the temporary user and
the guest must not share the same ID. Otherwise, it will raise an error.
Co-authored-by: Andrei Bautu <abautu@gmail.com>
This patch wraps the login_failed_count logic in a resource lock and
forces a user preferences cache reload. Each thread must wait for the
lock and must fetch the current count before incrementing it. This
ensures that login_failed_count is correct across threads and that the
lockout threshold is correctly honoured.
Co-Authored-By: Sujith Haridasan <sujith@moodle.com>
Create a new profile field type, move all existing content of the fields
'icq', 'skype', 'aim', 'yahoo', 'msn' and 'url' in the mdl_user table to
theses new profile fields if needed.
AMOS BEGIN
MOV [aimid,core],[aimid,courseimage,profilefield_social]
MOV [yahooid,core],[yahooid,profilefield_social]
MOV [skypeid,core],[skypeid,profilefield_social]
MOV [icqnumber,core],[icqnumber,profilefield_social]
MOV [msnid,core],[msnid,profilefield_social]
MOV [webpage,core],[webpage,profilefield_social]
AMOS END
This class would belong more appropriately within the 'user' API
(core_user) instead of within the 'core' API, since it is
directly related to user data.
Since the class has only just been added to Moodle, now is a good
time to move it.
In all cases changes have been kept to a minimum while not making
the code completely horrible. For example, there are many instances
where it would probably be better to rewrite a query entirely, but
I have not done that (in order to reduce the risk of changes).
When searching for other users with the same email address, we perform
the case-insensitive and accent-sensitive search. That may be expensive
as some DBs such as MySQL cannot use the index in that case. Instead,
sequential scan of all the user records is performed and the comparison
uses the LOWER function to filter the matching records. This leads to
significant performance heavy queries which in turn represent a surface
for DoS attacks.
For that reason, we first perform accent-insensitive search for
potential candidates in a subselect, which can use the index. Only then
we perform the additional accent-sensitive search on this limited set or
records.
This reverts the change introduced by MDL-59298 where the password
change URL data is being assigned with a moodle_url object instead
of concatenating it.
* Make email query case-insensitive
* Check only for duplicate emails if $CFG->allowaccountssameemail
is empty.
* Compare the values in "Email address" and "Email (again)" in the
signup form in a case-insensitive fashion.
Also fixed call to get_string() and defined var 'errorlogtag'
in base class.
AMOS BEGIN
MOV [auth_dbusernotexist,auth_db],[auth_usernotexist,auth]
AMOS END
* get_identity_providers(): Retrieves available auth identity providers
* prepare_identity_providers_for_output(): Prepares auth identity
provider data for output (e.g. to templates, WS, etc)
* Use these helpers for the login renderer
Authentication has a hard coded list of valid internal user fields - but they are in a class variable. We need them
in oauth user_field_mapping so we need to move them to a central place and call them from oauth2 and auth.
Add a hook for auth plugins to be able to modify or check a user, before
raising any authentication errors.
The auth plugin needs to add a public function like this:
/**
* Pre user_login hook.
* This method is called from authenticate_user_login() right after the user
* object is generated. This gives the auth plugins an option to make adjustments
* before the verification process starts.
*
* @param object $user user object, later used for $USER
*/
public function pre_user_login_hook(&$user) {
// Override if needed.
}
This introduces a new hook allowing an auth plugin to redirect to an
external login page directly without redundant redirects to the standard
login page first, or where possible to authenticate the user and simply
continue loading the page without any redirects. For some protocols such
as SAML reducing the number of redirects to the bare minimum greatly
speeds up the login process on high latency networks.
Adding alternate name fields (firstnamephonetic, lastnamephonetic,
middlename, alternatename) to "Lock user fields" for all
authentification plugins. This is needed to sync alternate name fields
with external data sources and to lock them for editing.
Meirza