Merge "Disable Special:PasswordReset when $wgEnableEmail is false"

diff --git a/RELEASE-NOTES-1.22 b/RELEASE-NOTES-1.22
index 5bfc519..5fbf064 100644 (file)
--- a/RELEASE-NOTES-1.22
+++ b/RELEASE-NOTES-1.22
@@ -23,6 +23,9 @@ production.
   version of the Vector extension as this feature may conflict.
 
 === Bug fixes in 1.22 ===
+* Disable Special:PasswordReset when $wgEnableEmail. Previously one could still
+  navigate to the page by entering the URL directly.
+
 
 === API changes in 1.22 ===
 * (bug 46626) xmldoublequote parameter was removed. Because of a bug, the

diff --git a/includes/specials/SpecialPasswordReset.php b/includes/specials/SpecialPasswordReset.php
index 491fadc..6b335c3 100644 (file)
--- a/includes/specials/SpecialPasswordReset.php
+++ b/includes/specials/SpecialPasswordReset.php
@@ -292,7 +292,7 @@ class SpecialPasswordReset extends FormSpecialPage {
        }
 
        protected function canChangePassword( User $user ) {
-               global $wgPasswordResetRoutes, $wgAuth;
+               global $wgPasswordResetRoutes, $wgEnableEmail, $wgAuth;
 
                // Maybe password resets are disabled, or there are no allowable routes
                if ( !is_array( $wgPasswordResetRoutes ) ||
@@ -306,6 +306,11 @@ class SpecialPasswordReset extends FormSpecialPage {
                        return 'resetpass_forbidden';
                }
 
+               // Maybe email features have been disabled
+               if ( !$wgEnableEmail ) {
+                       return 'passwordreset-emaildisabled';
+               }
+
                // Maybe the user is blocked (check this here rather than relying on the parent
                // method as we have a more specific error message to use here
                if ( $user->isBlocked() ) {

diff --git a/languages/messages/MessagesEn.php b/languages/messages/MessagesEn.php
index db071e3..2dd8835 100644 (file)
--- a/languages/messages/MessagesEn.php
+++ b/languages/messages/MessagesEn.php
@@ -1220,6 +1220,7 @@ You may have already successfully changed your password or requested a new tempo
 'passwordreset-text'               => 'Complete this form to reset your password.',
 'passwordreset-legend'             => 'Reset password',
 'passwordreset-disabled'           => 'Password resets have been disabled on this wiki.',
+'passwordreset-emaildisabled'      => 'Email features have been disabled on this wiki.',
 'passwordreset-pretext'            => '{{PLURAL:$1||Enter one of the pieces of data below}}',
 'passwordreset-username'           => 'Username:',
 'passwordreset-domain'             => 'Domain:',

diff --git a/languages/messages/MessagesQqq.php b/languages/messages/MessagesQqq.php
index 045bd8b..50cfc82 100644 (file)
--- a/languages/messages/MessagesQqq.php
+++ b/languages/messages/MessagesQqq.php
@@ -1228,6 +1228,7 @@ See also:
 'passwordreset-text' => 'Text on [[Special:PasswordReset]]',
 'passwordreset-legend' => '{{Identical|Reset password}}',
 'passwordreset-disabled' => 'Used as error message in changing password.',
+'passwordreset-emaildisabled' => 'Used as error message in changing password when site\'s email feature is disabled.',
 'passwordreset-pretext' => 'These instructions are shown on the password reset dialogue, which can, in principle, take the user\'s email address as well as, or instead of, their username. This text displays above one or more fields, at least one of which needs to be completed, and the message does not know which routes are available, so it needs to refer to some vague noun rather than specifically "username".
 "One of the pieces of data" means "an info"/"a datum" (probably to be translatea with a singular noun in your language if available). Parameters:
 * $1 is the number of password reset routes. This is never 1, but always two or more. Thus, the first plural option is empty in English.',

diff --git a/maintenance/language/messages.inc b/maintenance/language/messages.inc
index 1b6ba3c..6dddebd 100644 (file)
--- a/maintenance/language/messages.inc
+++ b/maintenance/language/messages.inc
@@ -537,6 +537,7 @@ $wgMessageStructure = array(
                'passwordreset-text',
                'passwordreset-legend',
                'passwordreset-disabled',
+               'passwordreset-emaildisabled',
                'passwordreset-pretext',
                'passwordreset-username',
                'passwordreset-domain',