* (bug 6427) Block blocked IPs from using the mail password function

  to allow blocking of flooders

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index 9a39dbf..bfdea08 100644 (file)
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -66,6 +66,9 @@ it from source control: http://www.mediawiki.org/wiki/Download_from_SVN
 * (bug 7644) User creations that are aborted by hooks shouldn't be counted
   against account creations per day limit
 * (bug 7636) Show Firefox 2 users "shift-alt" as accesskey prefix
+* (bug 6427) Block blocked IPs from using the mail password function
+  to allow blocking of flooders
+
 
 == Languages updated ==
 

diff --git a/includes/SpecialUserlogin.php b/includes/SpecialUserlogin.php
index 64cb38d..1f56141 100644 (file)
--- a/includes/SpecialUserlogin.php
+++ b/includes/SpecialUserlogin.php
@@ -407,6 +407,13 @@ class LoginForm {
        function mailPassword() {
                global $wgUser, $wgOut;
                
+               # Check against blocked IPs
+               # fixme -- should we not?
+               if( $wgUser->isBlocked() ) {
+                       $this->mainLoginForm( wfMsg( 'blocked-mailpassword' ) );
+                       return;
+               }
+               
                # Check against the rate limiter
                if( $wgUser->pingLimiter( 'mailpassword' ) ) {
                        $wgOut->rateLimited();

diff --git a/languages/messages/MessagesEn.php b/languages/messages/MessagesEn.php
index 8798e55..769d3d6 100644 (file)
--- a/languages/messages/MessagesEn.php
+++ b/languages/messages/MessagesEn.php
@@ -728,6 +728,8 @@ your old password.',
 'passwordsent' => 'A new password has been sent to the e-mail address
 registered for "$1".
 Please log in again after you receive it.',
+'blocked-mailpassword' => 'Your IP address is blocked from editing, and so
+is not allowed to use the password recovery function to prevent abuse.',
 'eauthentsent' =>  'A confirmation e-mail has been sent to the nominated e-mail address.
 Before any other mail is sent to the account, you will have to follow the instructions in the e-mail,
 to confirm that the account is actually yours.',