(bug 30636) integrate the remaining functionality of the PasswordReset extension...

[lhc/web/wiklou.git] / includes / specials / SpecialPasswordReset.php

diff --git a/includes/specials/SpecialPasswordReset.php b/includes/specials/SpecialPasswordReset.php
index f8df831..b07ef80 100644 (file)
--- a/includes/specials/SpecialPasswordReset.php
+++ b/includes/specials/SpecialPasswordReset.php
@@ -28,6 +28,16 @@
  */
 class SpecialPasswordReset extends FormSpecialPage {
 
+       /**
+        * @var Message
+        */
+       private $email;
+
+       /**
+        * @var Status
+        */
+       private $result;
+
        public function __construct() {
                parent::__construct( 'PasswordReset' );
        }
@@ -69,6 +79,14 @@ class SpecialPasswordReset extends FormSpecialPage {
                        );
                }
 
+               if( $this->getUser()->isAllowed( 'passwordreset' ) ){
+                       $a['Capture'] = array(
+                               'type' => 'check',
+                               'label-message' => 'passwordreset-capture',
+                               'help-message' => 'passwordreset-capture-help',
+                       );
+               }
+
                return $a;
        }
 
@@ -109,6 +127,16 @@ class SpecialPasswordReset extends FormSpecialPage {
                        }
                }
 
+               if( isset( $data['Capture'] ) && !$this->getUser()->isAllowed( 'passwordreset' ) ){
+                       // The user knows they don't have the passwordreset permission, but they tried to spoof the form.  That's naughty
+                       throw new PermissionsError( 'passwordreset' );
+               }
+
+               /**
+                * @var $firstUser User
+                * @var $users User[]
+                */
+
                if ( isset( $data['Username'] ) && $data['Username'] !== '' ) {
                        $method = 'username';
                        $users = array( User::newFromName( $data['Username'] ) );
@@ -199,15 +227,15 @@ class SpecialPasswordReset extends FormSpecialPage {
                        $password = $user->randomPassword();
                        $user->setNewpassword( $password );
                        $user->saveSettings();
-                       $passwords[] = wfMessage( 'passwordreset-emailelement', $user->getName(), $password );
+                       $passwords[] = wfMessage( 'passwordreset-emailelement', $user->getName(), $password )->plain(); // We'll escape the whole thing later
                }
                $passwordBlock = implode( "\n\n", $passwords );
 
                // Send in the user's language; which should hopefully be the same
                $userLanguage = $firstUser->getOption( 'language' );
 
-               $body = wfMessage( $msg )->inLanguage( $userLanguage );
-               $body->params(
+               $this->email = wfMessage( $msg )->inLanguage( $userLanguage );
+               $this->email->params(
                        $username,
                        $passwordBlock,
                        count( $passwords ),
@@ -217,18 +245,38 @@ class SpecialPasswordReset extends FormSpecialPage {
 
                $title = wfMessage( 'passwordreset-emailtitle' );
 
-               $result = $firstUser->sendMail( $title->text(), $body->text() );
+               $this->result = $firstUser->sendMail( $title->escaped(), $this->email->escaped() );
 
-               if ( $result->isGood() ) {
+               // Blank the email if the user is not supposed to see it
+               if( !isset( $data['Capture'] ) || !$data['Capture'] ) {
+                       $this->email = null;
+               }
+
+               if ( $this->result->isGood() ) {
+                       return true;
+               } elseif( isset( $data['Capture'] ) && $data['Capture'] ){
+                       // The email didn't send, but maybe they knew that and that's why they captured it
                        return true;
                } else {
                        // @todo FIXME: The email didn't send, but we have already set the password throttle
                        // timestamp, so they won't be able to try again until it expires...  :(
-                       return array( array( 'mailerror', $result->getMessage() ) );
+                       return array( array( 'mailerror', $this->result->getMessage() ) );
                }
        }
 
        public function onSuccess() {
+               if( $this->getUser()->isAllowed( 'passwordreset' ) && $this->email != null ){
+                       // @todo: Logging
+
+                       if( $this->result->isGood() ){
+                               $this->getOutput()->addWikiMsg( 'passwordreset-emailsent-capture' );
+                       } else {
+                               $this->getOutput()->addWikiMsg( 'passwordreset-emailerror-capture', $this->result->getMessage() );
+                       }
+
+                       $this->getOutput()->addHTML( Html::rawElement( 'pre', array(), $this->email->escaped() ) );
+               }
+               
                $this->getOutput()->addWikiMsg( 'passwordreset-emailsent' );
                $this->getOutput()->returnToMain();
        }