3 * Holds shared logic for login and account creation pages.
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; either version 2 of the License, or
8 * (at your option) any later version.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License along
16 * with this program; if not, write to the Free Software Foundation, Inc.,
17 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
18 * http://www.gnu.org/copyleft/gpl.html
21 * @ingroup SpecialPage
24 use MediaWiki\Auth\AuthenticationRequest
;
25 use MediaWiki\Auth\AuthenticationResponse
;
26 use MediaWiki\Auth\AuthManager
;
27 use MediaWiki\Auth\Throttler
;
28 use MediaWiki\Logger\LoggerFactory
;
29 use MediaWiki\Session\SessionManager
;
33 * Holds shared logic for login and account creation pages.
35 * @ingroup SpecialPage
37 abstract class LoginSignupSpecialPage
extends AuthManagerSpecialPage
{
42 protected $mReturnToQuery;
44 protected $mStickHTTPS;
46 protected $mEntryError = '';
47 protected $mEntryErrorType = 'error';
49 protected $mLoaded = false;
50 protected $mSecureLoginUrl;
53 protected $securityLevel;
55 /** @var bool True if the user if creating an account for someone else. Flag used for internal
56 * communication, only set at the very end. */
57 protected $proxyAccountCreation;
58 /** @var User FIXME another flag for passing data. */
59 protected $targetUser;
64 /** @var FakeAuthTemplate */
65 protected $fakeTemplate;
67 abstract protected function isSignup();
70 * @param bool $direct True if the action was successful just now; false if that happened
71 * pre-redirection (so this handler was called already)
72 * @param StatusValue|null $extraMessages
75 abstract protected function successfulAction( $direct = false, $extraMessages = null );
78 * Logs to the authmanager-stats channel.
79 * @param bool $success
80 * @param string|null $status Error message key
82 abstract protected function logAuthResult( $success, $status = null );
84 public function __construct( $name ) {
85 global $wgUseMediaWikiUIEverywhere;
86 parent
::__construct( $name );
88 // Override UseMediaWikiEverywhere to true, to force login and create form to use mw ui
89 $wgUseMediaWikiUIEverywhere = true;
93 * Load data from request.
95 * @param string $subPage Subpage of Special:Userlogin
97 protected function load( $subPage ) {
98 global $wgSecureLogin;
100 if ( $this->mLoaded
) {
103 $this->mLoaded
= true;
105 $request = $this->getRequest();
107 $this->mPosted
= $request->wasPosted();
108 $this->mIsReturn
= $subPage === 'return';
109 $this->mAction
= $request->getVal( 'action' );
110 $this->mFromHTTP
= $request->getBool( 'fromhttp', false )
111 ||
$request->getBool( 'wpFromhttp', false );
112 $this->mStickHTTPS
= ( !$this->mFromHTTP
&& $request->getProtocol() === 'https' )
113 ||
$request->getBool( 'wpForceHttps', false );
114 $this->mLanguage
= $request->getText( 'uselang' );
115 $this->mReturnTo
= $request->getVal( 'returnto', '' );
116 $this->mReturnToQuery
= $request->getVal( 'returntoquery', '' );
118 $securityLevel = $this->getRequest()->getText( 'force' );
120 $securityLevel && AuthManager
::singleton()->securitySensitiveOperationStatus(
121 $securityLevel ) === AuthManager
::SEC_REAUTH
123 $this->securityLevel
= $securityLevel;
126 $this->loadAuth( $subPage );
128 $this->mToken
= $request->getVal( $this->getTokenName() );
130 // Show an error or warning passed on from a previous page
131 $entryError = $this->msg( $request->getVal( 'error', '' ) );
132 $entryWarning = $this->msg( $request->getVal( 'warning', '' ) );
133 // bc: provide login link as a parameter for messages where the translation
135 $loginreqlink = Linker
::linkKnown(
136 $this->getPageTitle(),
137 $this->msg( 'loginreqlink' )->escaped(),
140 'returnto' => $this->mReturnTo
,
141 'returntoquery' => $this->mReturnToQuery
,
142 'uselang' => $this->mLanguage
,
143 'fromhttp' => $wgSecureLogin && $this->mFromHTTP ?
'1' : null,
147 // Only show valid error or warning messages.
148 if ( $entryError->exists()
149 && in_array( $entryError->getKey(), LoginHelper
::getValidErrorMessages(), true )
151 $this->mEntryErrorType
= 'error';
152 $this->mEntryError
= $entryError->rawParams( $loginreqlink )->parse();
154 } elseif ( $entryWarning->exists()
155 && in_array( $entryWarning->getKey(), LoginHelper
::getValidErrorMessages(), true )
157 $this->mEntryErrorType
= 'warning';
158 $this->mEntryError
= $entryWarning->rawParams( $loginreqlink )->parse();
161 # 1. When switching accounts, it sucks to get automatically logged out
162 # 2. Do not return to PasswordReset after a successful password change
163 # but goto Wiki start page (Main_Page) instead ( bug 33997 )
164 $returnToTitle = Title
::newFromText( $this->mReturnTo
);
165 if ( is_object( $returnToTitle )
166 && ( $returnToTitle->isSpecial( 'Userlogout' )
167 ||
$returnToTitle->isSpecial( 'PasswordReset' ) )
169 $this->mReturnTo
= '';
170 $this->mReturnToQuery
= '';
174 protected function getPreservedParams( $withToken = false ) {
175 global $wgSecureLogin;
177 $params = parent
::getPreservedParams( $withToken );
179 'returnto' => $this->mReturnTo ?
: null,
180 'returntoquery' => $this->mReturnToQuery ?
: null,
182 if ( $wgSecureLogin && !$this->isSignup() ) {
183 $params['fromhttp'] = $this->mFromHTTP ?
'1' : null;
189 * @param string|null $subPage
191 public function execute( $subPage ) {
192 $authManager = AuthManager
::singleton();
193 $session = SessionManager
::getGlobalSession();
195 // Session data is used for various things in the authentication process, so we must make
196 // sure a session cookie or some equivalent mechanism is set.
199 $this->load( $subPage );
201 $this->checkPermissions();
203 // Make sure it's possible to log in
204 if ( !$this->isSignup() && !$session->canSetUser() ) {
205 throw new ErrorPageError( 'cannotloginnow-title', 'cannotloginnow-text', [
206 $session->getProvider()->describe( RequestContext
::getMain()->getLanguage() )
211 * In the case where the user is already logged in, and was redirected to
212 * the login form from a page that requires login, do not show the login
213 * page. The use case scenario for this is when a user opens a large number
214 * of tabs, is redirected to the login page on all of them, and then logs
215 * in on one, expecting all the others to work properly.
217 * However, do show the form if it was visited intentionally (no 'returnto'
218 * is present). People who often switch between several accounts have grown
219 * accustomed to this behavior.
221 * Also make an exception when force=<level> is set in the URL, which means the user must
222 * reauthenticate for security reasons.
224 if ( !$this->isSignup() && !$this->mPosted
&& !$this->securityLevel
&&
225 ( $this->mReturnTo
!== '' ||
$this->mReturnToQuery
!== '' ) &&
226 $this->getUser()->isLoggedIn()
228 $this->successfulAction();
231 // If logging in and not on HTTPS, either redirect to it or offer a link.
232 global $wgSecureLogin;
233 if ( $this->getRequest()->getProtocol() !== 'https' ) {
234 $title = $this->getFullTitle();
235 $query = $this->getPreservedParams( false ) +
[
237 ( $this->mEntryErrorType
=== 'error' ?
'error'
238 : 'warning' ) => $this->mEntryError
,
239 ] +
$this->getRequest()->getQueryValues();
240 $url = $title->getFullURL( $query, false, PROTO_HTTPS
);
241 if ( $wgSecureLogin && !$this->mFromHTTP
&&
242 wfCanIPUseHTTPS( $this->getRequest()->getIP() )
244 // Avoid infinite redirect
245 $url = wfAppendQuery( $url, 'fromhttp=1' );
246 $this->getOutput()->redirect( $url );
247 // Since we only do this redir to change proto, always vary
248 $this->getOutput()->addVaryHeader( 'X-Forwarded-Proto' );
252 // A wiki without HTTPS login support should set $wgServer to
253 // http://somehost, in which case the secure URL generated
254 // above won't actually start with https://
255 if ( substr( $url, 0, 8 ) === 'https://' ) {
256 $this->mSecureLoginUrl
= $url;
261 if ( !$this->isActionAllowed( $this->authAction
) ) {
262 // FIXME how do we explain this to the user? can we handle session loss better?
263 // messages used: authpage-cannot-login, authpage-cannot-login-continue,
264 // authpage-cannot-create, authpage-cannot-create-continue
265 $this->mainLoginForm( [], 'authpage-cannot-' . $this->authAction
);
269 $status = $this->trySubmit();
271 if ( !$status ||
!$status->isGood() ) {
272 $this->mainLoginForm( $this->authRequests
, $status ?
$status->getMessage() : '', 'error' );
276 /** @var AuthenticationResponse $response */
277 $response = $status->getValue();
279 $returnToUrl = $this->getPageTitle( 'return' )
280 ->getFullURL( $this->getPreservedParams( true ), false, PROTO_HTTPS
);
281 switch ( $response->status
) {
282 case AuthenticationResponse
::PASS
:
283 $this->logAuthResult( true );
284 $this->proxyAccountCreation
= $this->isSignup() && !$this->getUser()->isAnon();
285 $this->targetUser
= User
::newFromName( $response->username
);
288 !$this->proxyAccountCreation
289 && $response->loginRequest
290 && $authManager->canAuthenticateNow()
292 // successful registration; log the user in instantly
293 $response2 = $authManager->beginAuthentication( [ $response->loginRequest
],
295 if ( $response2->status
!== AuthenticationResponse
::PASS
) {
296 LoggerFactory
::getInstance( 'login' )
297 ->error( 'Could not log in after account creation' );
298 $this->successfulAction( true, Status
::newFatal( 'createacct-loginerror' ) );
303 if ( !$this->proxyAccountCreation
) {
304 // Ensure that the context user is the same as the session user.
305 $this->setSessionUserForCurrentRequest();
308 $this->successfulAction( true );
310 case AuthenticationResponse
::FAIL
:
312 case AuthenticationResponse
::RESTART
:
313 unset( $this->authForm
);
314 if ( $response->status
=== AuthenticationResponse
::FAIL
) {
315 $action = $this->getDefaultAction( $subPage );
316 $messageType = 'error';
318 $action = $this->getContinueAction( $this->authAction
);
319 $messageType = 'warning';
321 $this->logAuthResult( false, $response->message ?
$response->message
->getKey() : '-' );
322 $this->loadAuth( $subPage, $action, true );
323 $this->mainLoginForm( $this->authRequests
, $response->message
, $messageType );
325 case AuthenticationResponse
::REDIRECT
:
326 unset( $this->authForm
);
327 $this->getOutput()->redirect( $response->redirectTarget
);
329 case AuthenticationResponse
::UI
:
330 unset( $this->authForm
);
331 $this->authAction
= $this->isSignup() ? AuthManager
::ACTION_CREATE_CONTINUE
332 : AuthManager
::ACTION_LOGIN_CONTINUE
;
333 $this->authRequests
= $response->neededRequests
;
334 $this->mainLoginForm( $response->neededRequests
, $response->message
, 'warning' );
337 throw new LogicException( 'invalid AuthenticationResponse' );
342 * Show the success page.
344 * @param string $type Condition of return to; see `executeReturnTo`
345 * @param string|Message $title Page's title
346 * @param string $msgname
347 * @param string $injected_html
348 * @param StatusValue|null $extraMessages
350 protected function showSuccessPage(
351 $type, $title, $msgname, $injected_html, $extraMessages
353 $out = $this->getOutput();
354 $out->setPageTitle( $title );
356 $out->addWikiMsg( $msgname, wfEscapeWikiText( $this->getUser()->getName() ) );
358 if ( $extraMessages ) {
359 $extraMessages = Status
::wrap( $extraMessages );
360 $out->addWikiText( $extraMessages->getWikiText() );
363 $out->addHTML( $injected_html );
365 $helper = new LoginHelper( $this->getContext() );
366 $helper->showReturnToPage( $type, $this->mReturnTo
, $this->mReturnToQuery
, $this->mStickHTTPS
);
370 * Add a "return to" link or redirect to it.
371 * Extensions can use this to reuse the "return to" logic after
372 * inject steps (such as redirection) into the login process.
374 * @param string $type One of the following:
375 * - error: display a return to link ignoring $wgRedirectOnLogin
376 * - signup: display a return to link using $wgRedirectOnLogin if needed
377 * - success: display a return to link using $wgRedirectOnLogin if needed
378 * - successredirect: send an HTTP redirect using $wgRedirectOnLogin if needed
379 * @param string $returnTo
380 * @param array|string $returnToQuery
381 * @param bool $stickHTTPS Keep redirect link on HTTPS
384 public function showReturnToPage(
385 $type, $returnTo = '', $returnToQuery = '', $stickHTTPS = false
387 $helper = new LoginHelper( $this->getContext() );
388 $helper->showReturnToPage( $type, $returnTo, $returnToQuery, $stickHTTPS );
392 * Replace some globals to make sure the fact that the user has just been logged in is
393 * reflected in the current request.
396 protected function setSessionUserForCurrentRequest() {
397 global $wgUser, $wgLang;
399 $context = RequestContext
::getMain();
400 $localContext = $this->getContext();
401 if ( $context !== $localContext ) {
402 // remove AuthManagerSpecialPage context hack
403 $this->setContext( $context );
406 $user = $context->getRequest()->getSession()->getUser();
409 $context->setUser( $user );
411 $code = $this->getRequest()->getVal( 'uselang', $user->getOption( 'language' ) );
412 $userLang = Language
::factory( $code );
414 $context->setLanguage( $userLang );
418 * @param AuthenticationRequest[] $requests A list of AuthorizationRequest objects,
419 * used to generate the form fields. An empty array means a fatal error
420 * (authentication cannot continue).
421 * @param string|Message $msg
422 * @param string $msgtype
423 * @throws ErrorPageError
426 * @throws MWException
427 * @throws PermissionsError
428 * @throws ReadOnlyError
431 protected function mainLoginForm( array $requests, $msg = '', $msgtype = 'error' ) {
432 $titleObj = $this->getPageTitle();
433 $user = $this->getUser();
434 $out = $this->getOutput();
436 // FIXME how to handle empty $requests - restart, or no form, just an error message?
437 // no form would be better for no session type errors, restart is better when can* fails.
439 $this->authAction
= $this->getDefaultAction( $this->subPage
);
440 $this->authForm
= null;
441 $requests = AuthManager
::singleton()->getAuthenticationRequests( $this->authAction
, $user );
444 // Generic styles and scripts for both login and signup form
445 $out->addModuleStyles( [
447 'mediawiki.ui.button',
448 'mediawiki.ui.checkbox',
449 'mediawiki.ui.input',
450 'mediawiki.special.userlogin.common.styles'
452 if ( $this->isSignup() ) {
453 // XXX hack pending RL or JS parse() support for complex content messages T27349
454 $out->addJsConfigVars( 'wgCreateacctImgcaptchaHelp',
455 $this->msg( 'createacct-imgcaptcha-help' )->parse() );
457 // Additional styles and scripts for signup form
459 'mediawiki.special.userlogin.signup.js'
461 $out->addModuleStyles( [
462 'mediawiki.special.userlogin.signup.styles'
465 // Additional styles for login form
466 $out->addModuleStyles( [
467 'mediawiki.special.userlogin.login.styles'
470 $out->disallowUserJs(); // just in case...
472 $form = $this->getAuthForm( $requests, $this->authAction
, $msg, $msgtype );
473 $form->prepareForm();
474 $formHtml = $form->getHTML( $msg ? Status
::newFatal( $msg ) : false );
476 $out->addHTML( $this->getPageHtml( $formHtml ) );
480 * Add page elements which are outside the form.
481 * FIXME this should probably be a template, but use a sane language (handlebars?)
482 * @param string $formHtml
485 protected function getPageHtml( $formHtml ) {
486 global $wgLoginLanguageSelector;
488 $loginPrompt = $this->isSignup() ?
'' : Html
::rawElement( 'div',
489 [ 'id' => 'userloginprompt' ], $this->msg( 'loginprompt' )->parseAsBlock() );
490 $languageLinks = $wgLoginLanguageSelector ?
$this->makeLanguageSelector() : '';
491 $signupStartMsg = $this->msg( 'signupstart' );
492 $signupStart = ( $this->isSignup() && !$signupStartMsg->isDisabled() )
493 ? Html
::rawElement( 'div', [ 'id' => 'signupstart' ], $signupStartMsg->parseAsBlock() ) : '';
494 if ( $languageLinks ) {
495 $languageLinks = Html
::rawElement( 'div', [ 'id' => 'languagelinks' ],
496 Html
::rawElement( 'p', [], $languageLinks )
500 $benefitsContainer = '';
501 if ( $this->isSignup() && $this->showExtraInformation() ) {
503 // createacct-benefit-icon1 createacct-benefit-head1 createacct-benefit-body1
504 // createacct-benefit-icon2 createacct-benefit-head2 createacct-benefit-body2
505 // createacct-benefit-icon3 createacct-benefit-head3 createacct-benefit-body3
508 for ( $benefitIdx = 1; $benefitIdx <= $benefitCount; $benefitIdx++
) {
509 $headUnescaped = $this->msg( "createacct-benefit-head$benefitIdx" )->text();
510 $iconClass = $this->msg( "createacct-benefit-icon$benefitIdx" )->escaped();
511 $benefitList .= Html
::rawElement( 'div', [ 'class' => "mw-number-text $iconClass" ],
512 Html
::rawElement( 'h3', [],
513 $this->msg( "createacct-benefit-head$benefitIdx" )->escaped()
515 . Html
::rawElement( 'p', [],
516 $this->msg( "createacct-benefit-body$benefitIdx" )->params( $headUnescaped )->escaped()
520 $benefitsContainer = Html
::rawElement( 'div', [ 'class' => 'mw-createacct-benefits-container' ],
521 Html
::rawElement( 'h2', [], $this->msg( 'createacct-benefit-heading' )->escaped() )
522 . Html
::rawElement( 'div', [ 'class' => 'mw-createacct-benefits-list' ],
528 $html = Html
::rawElement( 'div', [ 'class' => 'mw-ui-container' ],
532 . Html
::rawElement( 'div', [ 'id' => 'userloginForm' ],
542 * Generates a form from the given request.
543 * @param AuthenticationRequest[] $requests
544 * @param string $action AuthManager action name
545 * @param string|Message $msg
546 * @param string $msgType
549 protected function getAuthForm( array $requests, $action, $msg = '', $msgType = 'error' ) {
550 global $wgSecureLogin, $wgLoginLanguageSelector;
551 // FIXME merge this with parent
553 if ( isset( $this->authForm
) ) {
554 return $this->authForm
;
557 $usingHTTPS = $this->getRequest()->getProtocol() === 'https';
559 // get basic form description from the auth logic
560 $fieldInfo = AuthenticationRequest
::mergeFieldInfo( $requests );
561 $fakeTemplate = $this->getFakeTemplate( $msg, $msgType );
562 $this->fakeTemplate
= $fakeTemplate; // FIXME there should be a saner way to pass this to the hook
563 // this will call onAuthChangeFormFields()
564 $formDescriptor = static::fieldInfoToFormDescriptor( $requests, $fieldInfo, $this->authAction
);
565 $this->postProcessFormDescriptor( $formDescriptor );
567 $context = $this->getContext();
568 if ( $context->getRequest() !== $this->getRequest() ) {
569 // We have overridden the request, need to make sure the form uses that too.
570 $context = new DerivativeContext( $this->getContext() );
571 $context->setRequest( $this->getRequest() );
573 $form = HTMLForm
::factory( 'vform', $formDescriptor, $context );
575 $form->addHiddenField( 'authAction', $this->authAction
);
576 if ( $wgLoginLanguageSelector ) {
577 $form->addHiddenField( 'uselang', $this->mLanguage
);
579 $form->addHiddenField( 'force', $this->securityLevel
);
580 $form->addHiddenField( $this->getTokenName(), $this->getToken()->toString() );
581 if ( $wgSecureLogin ) {
582 // If using HTTPS coming from HTTP, then the 'fromhttp' parameter must be preserved
583 if ( !$this->isSignup() ) {
584 $form->addHiddenField( 'wpForceHttps', (int)$this->mStickHTTPS
);
585 $form->addHiddenField( 'wpFromhttp', $usingHTTPS );
589 // set properties of the form itself
590 $form->setAction( $this->getPageTitle()->getLocalURL( $this->getReturnToQueryStringFragment() ) );
591 $form->setName( 'userlogin' . ( $this->isSignup() ?
'2' : '' ) );
592 if ( $this->isSignup() ) {
593 $form->setId( 'userlogin2' );
597 // header used by ConfirmEdit, CondfirmAccount, Persona, WikimediaIncubator, SemanticSignup
598 // should be above the error message but HTMLForm doesn't support that
599 $form->addHeaderText( $fakeTemplate->html( 'header' ) );
601 // FIXME the old form used this for error/warning messages which does not play well with
602 // HTMLForm (maybe it could with a subclass?); for now only display it for signups
603 // (where the JS username validation needs it) and alway empty
604 if ( $this->isSignup() ) {
605 // used by the mediawiki.special.userlogin.signup.js module
606 $statusAreaAttribs = [ 'id' => 'mw-createacct-status-area' ];
607 // $statusAreaAttribs += $msg ? [ 'class' => "{$msgType}box" ] : [ 'style' => 'display: none;' ];
608 $form->addHeaderText( Html
::element( 'div', $statusAreaAttribs ) );
611 // header used by MobileFrontend
612 $form->addHeaderText( $fakeTemplate->html( 'formheader' ) );
614 // blank signup footer for site customization
615 if ( $this->isSignup() && $this->showExtraInformation() ) {
616 // Use signupend-https for HTTPS requests if it's not blank, signupend otherwise
617 $signupendMsg = $this->msg( 'signupend' );
618 $signupendHttpsMsg = $this->msg( 'signupend-https' );
619 if ( !$signupendMsg->isDisabled() ) {
620 $signupendText = ( $usingHTTPS && !$signupendHttpsMsg->isBlank() )
621 ?
$signupendHttpsMsg ->parse() : $signupendMsg->parse();
622 $form->addPostText( Html
::rawElement( 'div', [ 'id' => 'signupend' ], $signupendText ) );
626 // warning header for non-standard workflows (e.g. security reauthentication)
627 if ( !$this->isSignup() && $this->getUser()->isLoggedIn() ) {
628 $reauthMessage = $this->securityLevel ?
'userlogin-reauth' : 'userlogin-loggedin';
629 $form->addHeaderText( Html
::rawElement( 'div', [ 'class' => 'warningbox' ],
630 $this->msg( $reauthMessage )->params( $this->getUser()->getName() )->parse() ) );
633 if ( !$this->isSignup() && $this->showExtraInformation() ) {
634 $passwordReset = new PasswordReset( $this->getConfig(), AuthManager
::singleton() );
635 if ( $passwordReset->isAllowed( $this->getUser() ) ) {
636 $form->addFooterText( Html
::rawElement(
638 [ 'class' => 'mw-ui-vform-field mw-form-related-link-container' ],
640 SpecialPage
::getTitleFor( 'PasswordReset' ),
641 $this->msg( 'userlogin-resetpassword-link' )->escaped()
646 // Don't show a "create account" link if the user can't.
647 if ( $this->showCreateAccountLink() ) {
648 // link to the other action
649 $linkTitle = $this->getTitleFor( $this->isSignup() ?
'Userlogin' :'CreateAccount' );
650 $linkq = $this->getReturnToQueryStringFragment();
651 // Pass any language selection on to the mode switch link
652 if ( $wgLoginLanguageSelector && $this->mLanguage
) {
653 $linkq .= '&uselang=' . $this->mLanguage
;
655 $createOrLoginHref = $linkTitle->getLocalURL( $linkq );
657 if ( $this->getUser()->isLoggedIn() ) {
658 $createOrLoginHtml = Html
::rawElement( 'div',
659 [ 'class' => 'mw-ui-vform-field' ],
662 'id' => 'mw-createaccount-join',
663 'href' => $createOrLoginHref,
664 // put right after all auth inputs in the tab order
667 $this->msg( 'userlogin-createanother' )->escaped()
671 $createOrLoginHtml = Html
::rawElement( 'div',
672 [ 'id' => 'mw-createaccount-cta',
673 'class' => 'mw-ui-vform-field' ],
674 $this->msg( 'userlogin-noaccount' )->escaped()
675 . Html
::element( 'a',
677 'id' => 'mw-createaccount-join',
678 'href' => $createOrLoginHref,
679 'class' => 'mw-ui-button',
682 $this->msg( 'userlogin-joinproject' )->escaped()
686 $form->addFooterText( $createOrLoginHtml );
690 $form->suppressDefaultSubmit();
692 $this->authForm
= $form;
698 * Temporary B/C method to handle extensions using the UserLoginForm/UserCreateForm hooks.
699 * @param string|Message $msg
700 * @param string $msgType
701 * @return FakeAuthTemplate
703 protected function getFakeTemplate( $msg, $msgType ) {
704 global $wgAuth, $wgEnableEmail, $wgHiddenPrefs, $wgEmailConfirmToEdit, $wgEnableUserEmail,
705 $wgSecureLogin, $wgLoginLanguageSelector, $wgPasswordResetRoutes;
707 // make a best effort to get the value of fields which used to be fixed in the old login
708 // template but now might or might not exist depending on what providers are used
709 $request = $this->getRequest();
711 'mUsername' => $request->getText( 'wpName' ),
712 'mPassword' => $request->getText( 'wpPassword' ),
713 'mRetype' => $request->getText( 'wpRetype' ),
714 'mEmail' => $request->getText( 'wpEmail' ),
715 'mRealName' => $request->getText( 'wpRealName' ),
716 'mDomain' => $request->getText( 'wpDomain' ),
717 'mReason' => $request->getText( 'wpReason' ),
718 'mRemember' => $request->getCheck( 'wpRemember' ),
721 // Preserves a bunch of logic from the old code that was rewritten in getAuthForm().
722 // There is no code reuse to make this easier to remove .
723 // If an extension tries to change any of these values, they are out of luck - we only
724 // actually use the domain/usedomain/domainnames, extraInput and extrafields keys.
726 $titleObj = $this->getPageTitle();
727 $user = $this->getUser();
728 $template = new FakeAuthTemplate();
730 // Pre-fill username (if not creating an account, bug 44775).
731 if ( $data->mUsername
== '' && $this->isSignup() ) {
732 if ( $user->isLoggedIn() ) {
733 $data->mUsername
= $user->getName();
735 $data->mUsername
= $this->getRequest()->getSession()->suggestLoginUsername();
739 if ( $this->isSignup() ) {
740 // Must match number of benefits defined in messages
741 $template->set( 'benefitCount', 3 );
743 $q = 'action=submitlogin&type=signup';
744 $linkq = 'type=login';
746 $q = 'action=submitlogin&type=login';
747 $linkq = 'type=signup';
750 if ( $this->mReturnTo
!== '' ) {
751 $returnto = '&returnto=' . wfUrlencode( $this->mReturnTo
);
752 if ( $this->mReturnToQuery
!== '' ) {
753 $returnto .= '&returntoquery=' .
754 wfUrlencode( $this->mReturnToQuery
);
760 # Don't show a "create account" link if the user can't.
761 if ( $this->showCreateAccountLink() ) {
762 # Pass any language selection on to the mode switch link
763 if ( $wgLoginLanguageSelector && $this->mLanguage
) {
764 $linkq .= '&uselang=' . $this->mLanguage
;
766 // Supply URL, login template creates the button.
767 $template->set( 'createOrLoginHref', $titleObj->getLocalURL( $linkq ) );
769 $template->set( 'link', '' );
772 $resetLink = $this->isSignup()
774 : is_array( $wgPasswordResetRoutes )
775 && in_array( true, array_values( $wgPasswordResetRoutes ), true );
777 $template->set( 'header', '' );
778 $template->set( 'formheader', '' );
779 $template->set( 'skin', $this->getSkin() );
781 $template->set( 'name', $data->mUsername
);
782 $template->set( 'password', $data->mPassword
);
783 $template->set( 'retype', $data->mRetype
);
784 $template->set( 'createemailset', false ); // no easy way to get that from AuthManager
785 $template->set( 'email', $data->mEmail
);
786 $template->set( 'realname', $data->mRealName
);
787 $template->set( 'domain', $data->mDomain
);
788 $template->set( 'reason', $data->mReason
);
789 $template->set( 'remember', $data->mRemember
);
791 $template->set( 'action', $titleObj->getLocalURL( $q ) );
792 $template->set( 'message', $msg );
793 $template->set( 'messagetype', $msgType );
794 $template->set( 'createemail', $wgEnableEmail && $user->isLoggedIn() );
795 $template->set( 'userealname', !in_array( 'realname', $wgHiddenPrefs, true ) );
796 $template->set( 'useemail', $wgEnableEmail );
797 $template->set( 'emailrequired', $wgEmailConfirmToEdit );
798 $template->set( 'emailothers', $wgEnableUserEmail );
799 $template->set( 'canreset', $wgAuth->allowPasswordChange() );
800 $template->set( 'resetlink', $resetLink );
801 $template->set( 'canremember', $request->getSession()->getProvider()
802 ->getRememberUserDuration() !== null );
803 $template->set( 'usereason', $user->isLoggedIn() );
804 $template->set( 'cansecurelogin', ( $wgSecureLogin ) );
805 $template->set( 'stickhttps', (int)$this->mStickHTTPS
);
806 $template->set( 'loggedin', $user->isLoggedIn() );
807 $template->set( 'loggedinuser', $user->getName() );
808 $template->set( 'token', $this->getToken()->toString() );
810 $action = $this->isSignup() ?
'signup' : 'login';
811 $wgAuth->modifyUITemplate( $template, $action );
813 $oldTemplate = $template;
814 $hookName = $this->isSignup() ?
'UserCreateForm' : 'UserLoginForm';
815 Hooks
::run( $hookName, [ &$template ] );
816 if ( $oldTemplate !== $template ) {
817 wfDeprecated( "reference in $hookName hook", '1.27' );
824 public function onAuthChangeFormFields(
825 array $requests, array $fieldInfo, array &$formDescriptor, $action
827 $coreFieldDescriptors = $this->getFieldDefinitions( $this->fakeTemplate
);
828 $specialFields = array_merge( [ 'extraInput', 'linkcontainer', 'entryError' ],
829 array_keys( $this->fakeTemplate
->getExtraInputDefinitions() ) );
831 // keep the ordering from getCoreFieldDescriptors() where there is no explicit weight
832 foreach ( $coreFieldDescriptors as $fieldName => $coreField ) {
833 $requestField = isset( $formDescriptor[$fieldName] ) ?
834 $formDescriptor[$fieldName] : [];
836 // remove everything that is not in the fieldinfo, is not marked as a supplemental field
837 // to something in the fieldinfo, and is not a generic or B/C field or a submit button
839 !isset( $fieldInfo[$fieldName] )
841 !isset( $coreField['baseField'] )
842 ||
!isset( $fieldInfo[$coreField['baseField']] )
843 ) && !in_array( $fieldName, $specialFields, true )
844 && $coreField['type'] !== 'submit'
846 $coreFieldDescriptors[$fieldName] = null;
850 // core message labels should always take priority
852 isset( $coreField['label'] )
853 ||
isset( $coreField['label-message'] )
854 ||
isset( $coreField['label-raw'] )
856 unset( $requestField['label'], $requestField['label-message'], $coreField['label-raw'] );
859 $coreFieldDescriptors[$fieldName] +
= $requestField;
862 $formDescriptor = array_filter( $coreFieldDescriptors +
$formDescriptor );
867 * Show extra information such as password recovery information, link from login to signup,
868 * CTA etc? Such information should only be shown on the "landing page", ie. when the user
869 * is at the first step of the authentication process.
872 protected function showExtraInformation() {
873 return $this->authAction
!== $this->getContinueAction( $this->authAction
)
874 && !$this->securityLevel
;
878 * Create a HTMLForm descriptor for the core login fields.
879 * @param FakeAuthTemplate $template B/C data (not used but needed by getBCFieldDefinitions)
882 protected function getFieldDefinitions( $template ) {
883 global $wgEmailConfirmToEdit;
885 $isLoggedIn = $this->getUser()->isLoggedIn();
886 $continuePart = $this->isContinued() ?
'continue-' : '';
887 $anotherPart = $isLoggedIn ?
'another-' : '';
888 $expiration = $this->getRequest()->getSession()->getProvider()
889 ->getRememberUserDuration();
890 $expirationDays = ceil( $expiration / ( 3600 * 24 ) );
891 $secureLoginLink = '';
892 if ( $this->mSecureLoginUrl
) {
893 $secureLoginLink = Html
::element( 'a', [
894 'href' => $this->mSecureLoginUrl
,
895 'class' => 'mw-ui-flush-right mw-secure',
896 ], $this->msg( 'userlogin-signwithsecure' )->text() );
899 if ( $this->isSignup() ) {
900 $fieldDefinitions = [
902 'label-message' => 'userlogin-yourname',
903 // FIXME help-message does not match old formatting
904 'help-message' => 'createacct-helpusername',
906 'placeholder-message' => $isLoggedIn ?
'createacct-another-username-ph'
907 : 'userlogin-yourname-ph',
910 // create account without providing password, a temporary one will be mailed
912 'label-message' => 'createaccountmail',
913 'name' => 'wpCreateaccountMail',
914 'id' => 'wpCreateaccountMail',
917 'id' => 'wpPassword2',
918 'placeholder-message' => 'createacct-yourpassword-ph',
919 'hide-if' => [ '===', 'wpCreateaccountMail', '1' ],
923 'baseField' => 'password',
924 'type' => 'password',
925 'label-message' => 'createacct-yourpasswordagain',
927 'cssclass' => 'loginPassword',
929 'validation-callback' => function ( $value, $alldata ) {
930 if ( empty( $alldata['mailpassword'] ) && !empty( $alldata['password'] ) ) {
932 return $this->msg( 'htmlform-required' );
933 } elseif ( $value !== $alldata['password'] ) {
934 return $this->msg( 'badretype' );
939 'hide-if' => [ '===', 'wpCreateaccountMail', '1' ],
940 'placeholder-message' => 'createacct-yourpasswordagain-ph',
944 'label-message' => $wgEmailConfirmToEdit ?
'createacct-emailrequired'
945 : 'createacct-emailoptional',
947 'cssclass' => 'loginText',
949 // FIXME will break non-standard providers
950 'required' => $wgEmailConfirmToEdit,
951 'validation-callback' => function ( $value, $alldata ) {
952 global $wgEmailConfirmToEdit;
954 // AuthManager will check most of these, but that will make the auth
955 // session fail and this won't, so nicer to do it this way
956 if ( !$value && $wgEmailConfirmToEdit ) {
957 // no point in allowing registration without email when email is
959 return $this->msg( 'noemailtitle' );
960 } elseif ( !$value && !empty( $alldata['mailpassword'] ) ) {
961 // cannot send password via email when there is no email address
962 return $this->msg( 'noemailcreate' );
963 } elseif ( $value && !Sanitizer
::validateEmail( $value ) ) {
964 return $this->msg( 'invalidemailaddress' );
968 'placeholder-message' => 'createacct-' . $anotherPart . 'email-ph',
972 'help-message' => $isLoggedIn ?
'createacct-another-realname-tip'
973 : 'prefs-help-realname',
974 'label-message' => 'createacct-realname',
975 'cssclass' => 'loginText',
977 'id' => 'wpRealName',
980 // comment for the user creation log
982 'label-message' => 'createacct-reason',
983 'cssclass' => 'loginText',
986 'placeholder-message' => 'createacct-reason-ph',
988 'extrainput' => [], // placeholder for fields coming from the template
992 'default' => $this->msg( 'createacct-' . $anotherPart . $continuePart .
994 'name' => 'wpCreateaccount',
995 'id' => 'wpCreateaccount',
1000 $fieldDefinitions = [
1002 'label-raw' => $this->msg( 'userlogin-yourname' )->escaped() . $secureLoginLink,
1004 'placeholder-message' => 'userlogin-yourname-ph',
1007 'id' => 'wpPassword1',
1008 'placeholder-message' => 'userlogin-yourpassword-ph',
1013 // option for saving the user token to a cookie
1015 'label-message' => $this->msg( 'userlogin-remembermypassword' )
1016 ->numParams( $expirationDays ),
1017 'id' => 'wpRemember',
1022 'name' => 'wpRemember',
1023 'default' => $this->msg( 'pt-login-' . $continuePart . 'button' )->text(),
1024 'id' => 'wpLoginAttempt',
1027 'linkcontainer' => [
1030 'cssclass' => 'mw-form-related-link-container mw-userlogin-help',
1031 // 'id' => 'mw-userlogin-help', // FIXME HTMLInfoField ignores this
1033 'default' => Html
::element( 'a', [
1034 'href' => Skin
::makeInternalOrExternalUrl( wfMessage( 'helplogin-url' )
1035 ->inContentLanguage()
1037 ], $this->msg( 'userlogin-helplink2' )->text() ),
1042 $fieldDefinitions['username'] +
= [
1045 'cssclass' => 'loginText',
1047 // 'required' => true,
1049 $fieldDefinitions['password'] +
= [
1050 'type' => 'password',
1051 // 'label-message' => 'userlogin-yourpassword', // would override the changepassword label
1052 'name' => 'wpPassword',
1053 'cssclass' => 'loginPassword',
1055 // 'required' => true,
1058 if ( $this->mEntryError
) {
1059 $fieldDefinitions['entryError'] = [
1061 'default' => Html
::rawElement( 'div', [ 'class' => $this->mEntryErrorType
. 'box', ],
1062 $this->mEntryError
),
1069 if ( !$this->showExtraInformation() ) {
1070 unset( $fieldDefinitions['linkcontainer'] );
1073 $fieldDefinitions = $this->getBCFieldDefinitions( $fieldDefinitions, $template );
1074 $fieldDefinitions = array_filter( $fieldDefinitions );
1076 return $fieldDefinitions;
1080 * Adds fields provided via the deprecated UserLoginForm / UserCreateForm hooks
1081 * @param $fieldDefinitions array
1082 * @param FakeAuthTemplate $template
1085 protected function getBCFieldDefinitions( $fieldDefinitions, $template ) {
1086 if ( $template->get( 'usedomain', false ) ) {
1087 // TODO probably should be translated to the new domain notation in AuthManager
1088 $fieldDefinitions['domain'] = [
1090 'label-message' => 'yourdomainname',
1091 'options' => array_combine( $template->get( 'domainnames', [] ),
1092 $template->get( 'domainnames', [] ) ),
1093 'default' => $template->get( 'domain', '' ),
1094 'name' => 'wpDomain',
1095 // FIXME id => 'mw-user-domain-section' on the parent div
1099 // poor man's associative array_splice
1100 $extraInputPos = array_search( 'extrainput', array_keys( $fieldDefinitions ), true );
1101 $fieldDefinitions = array_slice( $fieldDefinitions, 0, $extraInputPos, true )
1102 +
$template->getExtraInputDefinitions()
1103 +
array_slice( $fieldDefinitions, $extraInputPos +
1, null, true );
1105 return $fieldDefinitions;
1109 * Check if a session cookie is present.
1111 * This will not pick up a cookie set during _this_ request, but is meant
1112 * to ensure that the client is returning the cookie which was set on a
1113 * previous pass through the system.
1117 protected function hasSessionCookie() {
1118 global $wgDisableCookieCheck, $wgInitialSessionId;
1120 return $wgDisableCookieCheck ||
(
1121 $wgInitialSessionId &&
1122 $this->getRequest()->getSession()->getId() === (string)$wgInitialSessionId
1127 * Returns a string that can be appended to the URL (without encoding) to preserve the
1128 * return target. Does not include leading '?'/'&'.
1130 protected function getReturnToQueryStringFragment() {
1132 if ( $this->mReturnTo
!== '' ) {
1133 $returnto = 'returnto=' . wfUrlencode( $this->mReturnTo
);
1134 if ( $this->mReturnToQuery
!== '' ) {
1135 $returnto .= '&returntoquery=' . wfUrlencode( $this->mReturnToQuery
);
1142 * Whether the login/create account form should display a link to the
1143 * other form (in addition to whatever the skin provides).
1146 private function showCreateAccountLink() {
1147 if ( $this->isSignup() ) {
1149 } elseif ( $this->getUser()->isAllowed( 'createaccount' ) ) {
1156 protected function getTokenName() {
1157 return $this->isSignup() ?
'wpCreateaccountToken' : 'wpLoginToken';
1161 * Produce a bar of links which allow the user to select another language
1162 * during login/registration but retain "returnto"
1166 protected function makeLanguageSelector() {
1167 $msg = $this->msg( 'loginlanguagelinks' )->inContentLanguage();
1168 if ( $msg->isBlank() ) {
1171 $langs = explode( "\n", $msg->text() );
1173 foreach ( $langs as $lang ) {
1174 $lang = trim( $lang, '* ' );
1175 $parts = explode( '|', $lang );
1176 if ( count( $parts ) >= 2 ) {
1177 $links[] = $this->makeLanguageSelectorLink( $parts[0], trim( $parts[1] ) );
1181 return count( $links ) > 0 ?
$this->msg( 'loginlanguagelabel' )->rawParams(
1182 $this->getLanguage()->pipeList( $links ) )->escaped() : '';
1186 * Create a language selector link for a particular language
1187 * Links back to this page preserving type and returnto
1189 * @param string $text Link text
1190 * @param string $lang Language code
1193 protected function makeLanguageSelectorLink( $text, $lang ) {
1194 if ( $this->getLanguage()->getCode() == $lang ) {
1195 // no link for currently used language
1196 return htmlspecialchars( $text );
1198 $query = [ 'uselang' => $lang ];
1199 if ( $this->mReturnTo
!== '' ) {
1200 $query['returnto'] = $this->mReturnTo
;
1201 $query['returntoquery'] = $this->mReturnToQuery
;
1205 $targetLanguage = Language
::factory( $lang );
1206 $attr['lang'] = $attr['hreflang'] = $targetLanguage->getHtmlCode();
1208 return Linker
::linkKnown(
1209 $this->getPageTitle(),
1210 htmlspecialchars( $text ),
1216 protected function getGroupName() {
1221 * @param array $formDescriptor
1223 protected function postProcessFormDescriptor( &$formDescriptor ) {
1224 // Pre-fill username (if not creating an account, T46775).
1226 isset( $formDescriptor['username'] ) &&
1227 !isset( $formDescriptor['username']['default'] ) &&
1230 $user = $this->getUser();
1231 if ( $user->isLoggedIn() ) {
1232 $formDescriptor['username']['default'] = $user->getName();
1234 $formDescriptor['username']['default'] =
1235 $this->getRequest()->getSession()->suggestLoginUsername();
1239 // don't show a submit button if there is nothing to submit (i.e. the only form content
1240 // is other submit buttons, for redirect flows)
1241 if ( !$this->needsSubmitButton( $formDescriptor ) ) {
1242 unset( $formDescriptor['createaccount'], $formDescriptor['loginattempt'] );
1245 if ( !$this->isSignup() ) {
1246 // FIXME HACK don't focus on non-empty field
1247 // maybe there should be an autofocus-if similar to hide-if?
1249 isset( $formDescriptor['username'] )
1250 && empty( $formDescriptor['username']['default'] )
1251 && !$this->getRequest()->getCheck( 'wpName' )
1253 $formDescriptor['username']['autofocus'] = true;
1254 } elseif ( isset( $formDescriptor['password'] ) ) {
1255 $formDescriptor['password']['autofocus'] = true;
1259 $this->addTabIndex( $formDescriptor );
1264 * B/C class to try handling login/signup template modifications even though login/signup does not
1265 * actually happen through a template anymore. Just collects extra field definitions and allows
1266 * some other class to do decide what to do with threm..
1267 * TODO find the right place for adding extra fields and kill this
1269 class FakeAuthTemplate
extends BaseTemplate
{
1270 public function execute() {
1271 throw new LogicException( 'not used' );
1275 * Extensions (AntiSpoof and TitleBlacklist) call this in response to
1276 * UserCreateForm hook to add checkboxes to the create account form.
1278 public function addInputItem( $name, $value, $type, $msg, $helptext = false ) {
1279 // use the same indexes as UserCreateForm just in case someone adds an item manually
1280 $this->data
['extrainput'][] = [
1285 'helptext' => $helptext,
1290 * Turns addInputItem-style field definitions into HTMLForm field definitions.
1293 public function getExtraInputDefinitions() {
1296 foreach ( $this->get( 'extrainput', [] ) as $field ) {
1298 'type' => $field['type'] === 'checkbox' ?
'check' : $field['type'],
1299 'name' => $field['name'],
1300 'value' => $field['value'],
1301 'id' => $field['name'],
1303 if ( $field['msg'] ) {
1304 $definition['label-message'] = $this->getMsg( $field['msg'] );
1306 if ( $field['helptext'] ) {
1307 $definition['help'] = $this->msgWiki( $field['helptext'] );
1310 // the array key doesn't matter much when name is defined explicitly but
1311 // let's try and follow HTMLForm conventions
1312 $name = preg_replace( '/^wp(?=[A-Z])/', '', $field['name'] );
1313 $definitions[$name] = $definition;
1316 if ( $this->haveData( 'extrafields' ) ) {
1317 $definitions['extrafields'] = [
1320 'default' => $this->get( 'extrafields' ),
1324 return $definitions;
1329 * A horrible hack to handle AuthManager's feature flag. For other special pages this is done in
1330 * SpecialPageFactory, but LoginForm is used directly by some extensions. Will be killed as soon
1331 * as AuthManager is stable.
1333 class LoginForm
extends SpecialPage
{
1334 private $realLoginForm;
1336 public function __construct( $request = null ) {
1337 global $wgDisableAuthManager;
1338 if ( $wgDisableAuthManager ) {
1339 $this->realLoginForm
= new LoginFormPreAuthManager( $request );
1341 $this->realLoginForm
= new LoginFormAuthManager( $request );
1347 public function __get( $name ) {
1348 return $this->realLoginForm
->$name;
1351 public function __set( $name, $value ) {
1352 $this->realLoginForm
->$name = $value;
1355 public function __call( $name, $args ) {
1356 return call_user_func_array( [ $this->realLoginForm
, $name ], $args );
1359 public static function __callStatic( $name, $args ) {
1360 global $wgDisableAuthManager;
1361 return call_user_func_array( [ $wgDisableAuthManager ? LoginFormPreAuthManager
::class
1362 : LoginFormAuthManager
::class, $name ], $args );
1365 // all public SpecialPage methods need to be proxied explicitly
1367 public function getName() {
1368 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1370 public function getRestriction() {
1371 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1373 public function isListed() {
1374 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1376 public function setListed( $listed ) {
1377 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1379 public function listed( $x = null ) {
1380 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1382 public function isIncludable() {
1383 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1385 public function including( $x = null ) {
1386 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1388 public function getLocalName() {
1389 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1391 public function isExpensive() {
1392 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1394 public function isCached() {
1395 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1397 public function isRestricted() {
1398 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1400 public function userCanExecute( User
$user ) {
1401 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1403 public function displayRestrictionError() {
1404 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1406 public function checkPermissions() {
1407 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1409 public function checkReadOnly() {
1410 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1412 public function requireLogin(
1413 $reasonMsg = 'exception-nologin-text', $titleMsg = 'exception-nologin'
1415 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1417 public function prefixSearchSubpages( $search, $limit, $offset ) {
1418 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1420 public function execute( $subPage ) {
1421 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1423 public function getDescription() {
1424 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1426 function getTitle( $subpage = false ) {
1427 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1429 function getPageTitle( $subpage = false ) {
1430 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1432 public function setContext( $context ) {
1433 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1435 public function getContext() {
1436 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1438 public function getRequest() {
1439 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1441 public function getOutput() {
1442 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1444 public function getUser() {
1445 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1447 public function getSkin() {
1448 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1450 public function getLanguage() {
1451 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1453 public function getConfig() {
1454 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1456 public function getFullTitle() {
1457 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1459 public function getFinalGroupName() {
1460 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1462 public function doesWrites() {
1463 return call_user_func_array( [ $this->realLoginForm
, __FUNCTION__
], func_get_args() );
1466 // no way to proxy constants and static properties
1471 const WRONG_PLUGIN_PASS
= 3;
1472 const NOT_EXISTS
= 4;
1473 const WRONG_PASS
= 5;
1474 const EMPTY_PASS
= 6;
1475 const RESET_PASS
= 7;
1477 const CREATE_BLOCKED
= 9;
1478 const THROTTLED
= 10;
1479 const USER_BLOCKED
= 11;
1480 const NEED_TOKEN
= 12;
1481 const WRONG_TOKEN
= 13;
1482 const USER_MIGRATED
= 14;
1484 public static $statusCodes = [
1485 self
::SUCCESS
=> 'success',
1486 self
::NO_NAME
=> 'no_name',
1487 self
::ILLEGAL
=> 'illegal',
1488 self
::WRONG_PLUGIN_PASS
=> 'wrong_plugin_pass',
1489 self
::NOT_EXISTS
=> 'not_exists',
1490 self
::WRONG_PASS
=> 'wrong_pass',
1491 self
::EMPTY_PASS
=> 'empty_pass',
1492 self
::RESET_PASS
=> 'reset_pass',
1493 self
::ABORTED
=> 'aborted',
1494 self
::CREATE_BLOCKED
=> 'create_blocked',
1495 self
::THROTTLED
=> 'throttled',
1496 self
::USER_BLOCKED
=> 'user_blocked',
1497 self
::NEED_TOKEN
=> 'need_token',
1498 self
::WRONG_TOKEN
=> 'wrong_token',
1499 self
::USER_MIGRATED
=> 'user_migrated',
1502 public static $validErrorMessages = [
1503 'exception-nologin-text',
1504 'watchlistanontext',
1505 'changeemail-no-info',
1506 'resetpass-no-info',
1507 'confirmemail_needlogin',
1508 'prefsnologintext2',
1513 * LoginForm as a special page has been replaced by SpecialUserLogin and SpecialCreateAccount,
1514 * but some extensions called its public methods directly, so the class is retained as a
1515 * B/C wrapper. Anything that used it before should use AuthManager instead.
1517 class LoginFormAuthManager
extends SpecialPage
{
1521 const WRONG_PLUGIN_PASS
= 3;
1522 const NOT_EXISTS
= 4;
1523 const WRONG_PASS
= 5;
1524 const EMPTY_PASS
= 6;
1525 const RESET_PASS
= 7;
1527 const CREATE_BLOCKED
= 9;
1528 const THROTTLED
= 10;
1529 const USER_BLOCKED
= 11;
1530 const NEED_TOKEN
= 12;
1531 const WRONG_TOKEN
= 13;
1532 const USER_MIGRATED
= 14;
1534 public static $statusCodes = [
1535 self
::SUCCESS
=> 'success',
1536 self
::NO_NAME
=> 'no_name',
1537 self
::ILLEGAL
=> 'illegal',
1538 self
::WRONG_PLUGIN_PASS
=> 'wrong_plugin_pass',
1539 self
::NOT_EXISTS
=> 'not_exists',
1540 self
::WRONG_PASS
=> 'wrong_pass',
1541 self
::EMPTY_PASS
=> 'empty_pass',
1542 self
::RESET_PASS
=> 'reset_pass',
1543 self
::ABORTED
=> 'aborted',
1544 self
::CREATE_BLOCKED
=> 'create_blocked',
1545 self
::THROTTLED
=> 'throttled',
1546 self
::USER_BLOCKED
=> 'user_blocked',
1547 self
::NEED_TOKEN
=> 'need_token',
1548 self
::WRONG_TOKEN
=> 'wrong_token',
1549 self
::USER_MIGRATED
=> 'user_migrated',
1553 * @param WebRequest $request
1555 public function __construct( $request = null ) {
1556 wfDeprecated( 'LoginForm', '1.27' );
1557 parent
::__construct();
1561 * @deprecated since 1.27 - call LoginHelper::getValidErrorMessages instead.
1563 public static function getValidErrorMessages() {
1564 return LoginHelper
::getValidErrorMessages();
1568 * @deprecated since 1.27 - don't use LoginForm, use AuthManager instead
1570 public static function incrementLoginThrottle( $username ) {
1571 wfDeprecated( __METHOD__
, "1.27" );
1573 $username = User
::getCanonicalName( $username, 'usable' ) ?
: $username;
1574 $throttler = new Throttler();
1575 return $throttler->increase( $username, $wgRequest->getIP(), __METHOD__
);
1579 * @deprecated since 1.27 - don't use LoginForm, use AuthManager instead
1581 public static function incLoginThrottle( $username ) {
1582 wfDeprecated( __METHOD__
, "1.27" );
1583 $res = self
::incrementLoginThrottle( $username );
1584 return is_array( $res ) ?
true : 0;
1588 * @deprecated since 1.27 - don't use LoginForm, use AuthManager instead
1590 public static function clearLoginThrottle( $username ) {
1591 wfDeprecated( __METHOD__
, "1.27" );
1593 $username = User
::getCanonicalName( $username, 'usable' ) ?
: $username;
1594 $throttler = new Throttler();
1595 return $throttler->clear( $username, $wgRequest->getIP() );
1599 * @deprecated since 1.27 - don't use LoginForm, use AuthManager instead
1601 public static function getLoginToken() {
1602 wfDeprecated( __METHOD__
, '1.27' );
1604 return $wgRequest->getSession()->getToken( '', 'login' )->toString();
1608 * @deprecated since 1.27 - don't use LoginForm, use AuthManager instead
1610 public static function setLoginToken() {
1611 wfDeprecated( __METHOD__
, '1.27' );
1615 * @deprecated since 1.27 - don't use LoginForm, use AuthManager instead
1617 public static function clearLoginToken() {
1618 wfDeprecated( __METHOD__
, '1.27' );
1620 $wgRequest->getSession()->resetToken( 'login' );
1624 * @deprecated since 1.27 - don't use LoginForm, use AuthManager instead
1626 public static function getCreateaccountToken() {
1627 wfDeprecated( __METHOD__
, '1.27' );
1629 return $wgRequest->getSession()->getToken( '', 'createaccount' )->toString();
1633 * @deprecated since 1.27 - don't use LoginForm, use AuthManager instead
1635 public static function setCreateaccountToken() {
1636 wfDeprecated( __METHOD__
, '1.27' );
1640 * @deprecated since 1.27 - don't use LoginForm, use AuthManager instead
1642 public static function clearCreateaccountToken() {
1643 wfDeprecated( __METHOD__
, '1.27' );
1645 $wgRequest->getSession()->resetToken( 'createaccount' );