Merge "Default the "watchlisttoken" value to a derived HMAC value"

[lhc/web/wiklou.git] / includes / User.php

diff --git a/includes/User.php b/includes/User.php
index cefbe62..605dab6 100644 (file)
--- a/includes/User.php
+++ b/includes/User.php
@@ -519,19 +519,24 @@ class User implements IDBAccessObject {
         * If the code is invalid or has expired, returns NULL.
         *
         * @param string $code Confirmation code
+        * @param int $flags User::READ_* bitfield
         * @return User|null
         */
-       public static function newFromConfirmationCode( $code ) {
-               $dbr = wfGetDB( DB_SLAVE );
-               $id = $dbr->selectField( 'user', 'user_id', array(
-                       'user_email_token' => md5( $code ),
-                       'user_email_token_expires > ' . $dbr->addQuotes( $dbr->timestamp() ),
-                       ) );
-               if ( $id !== false ) {
-                       return User::newFromId( $id );
-               } else {
-                       return null;
-               }
+       public static function newFromConfirmationCode( $code, $flags = 0 ) {
+               $db = ( $flags & self::READ_LATEST ) == self::READ_LATEST
+                       ? wfGetDB( DB_MASTER )
+                       : wfGetDB( DB_SLAVE );
+
+               $id = $db->selectField(
+                       'user',
+                       'user_id',
+                       array(
+                               'user_email_token' => md5( $code ),
+                               'user_email_token_expires > ' . $db->addQuotes( $db->timestamp() ),
+                       )
+               );
+
+               return $id ? User::newFromId( $id ) : null;
        }
 
        /**
@@ -2433,6 +2438,7 @@ class User implements IDBAccessObject {
         */
        public function setInternalPassword( $str ) {
                $this->setToken();
+               $this->setOption( 'watchlisttoken', false );
 
                $passwordFactory = self::getPasswordFactory();
                $this->mPassword = $passwordFactory->newFromPlaintext( $str );
@@ -2710,20 +2716,24 @@ class User implements IDBAccessObject {
         * @return string|bool User's current value for the option, or false if this option is disabled.
         * @see resetTokenFromOption()
         * @see getOption()
+        * @deprecated 1.26 Applications should use the OAuth extension
         */
        public function getTokenFromOption( $oname ) {
                global $wgHiddenPrefs;
-               if ( in_array( $oname, $wgHiddenPrefs ) ) {
+
+               $id = $this->getId();
+               if ( !$id || in_array( $oname, $wgHiddenPrefs ) ) {
                        return false;
                }
 
                $token = $this->getOption( $oname );
                if ( !$token ) {
-                       $token = $this->resetTokenFromOption( $oname );
-                       if ( !wfReadOnly() ) {
-                               $this->saveSettings();
-                       }
+                       // Default to a value based on the user token to avoid space
+                       // wasted on storing tokens for all users. When this option
+                       // is set manually by the user, only then is it stored.
+                       $token = hash_hmac( 'sha1', "$oname:$id", $this->getToken() );
                }
+
                return $token;
        }
 
@@ -3203,10 +3213,10 @@ class User implements IDBAccessObject {
        /**
         * Check if user is allowed to access a feature / make an action
         *
-        * @param string $permissions,... Permissions to test
+        * @param string ... Permissions to test
         * @return bool True if user is allowed to perform *any* of the given actions
         */
-       public function isAllowedAny( /*...*/ ) {
+       public function isAllowedAny() {
                $permissions = func_get_args();
                foreach ( $permissions as $permission ) {
                        if ( $this->isAllowed( $permission ) ) {
@@ -3218,10 +3228,10 @@ class User implements IDBAccessObject {
 
        /**
         *
-        * @param string $permissions,... Permissions to test
+        * @param string ... Permissions to test
         * @return bool True if the user is allowed to perform *all* of the given actions
         */
-       public function isAllowedAll( /*...*/ ) {
+       public function isAllowedAll() {
                $permissions = func_get_args();
                foreach ( $permissions as $permission ) {
                        if ( !$this->isAllowed( $permission ) ) {
@@ -3454,7 +3464,7 @@ class User implements IDBAccessObject {
                        $dbw = wfGetDB( DB_MASTER );
                        $dbw->update( 'watchlist',
                                array( /* SET */ 'wl_notificationtimestamp' => null ),
-                               array( /* WHERE */ 'wl_user' => $id ),
+                               array( /* WHERE */ 'wl_user' => $id, 'wl_notificationtimestamp IS NOT NULL' ),
                                __METHOD__
                        );
                        // We also need to clear here the "you have new message" notification for the own user_talk page;