Merge "Prevent login-only local password provider from removing passwords"

diff --combined includes/auth/LocalPasswordPrimaryAuthenticationProvider.php
index 859fd0c,1013990..fd36887
--- 1/includes/auth/LocalPasswordPrimaryAuthenticationProvider.php
--- 2/includes/auth/LocalPasswordPrimaryAuthenticationProvider.php
+++ b/includes/auth/LocalPasswordPrimaryAuthenticationProvider.php
@@@ -104,7 -104,7 +104,7 @@@ class LocalPasswordPrimaryAuthenticatio
                // The old hash format was just an md5 hex hash, with no type information
                if ( preg_match( '/^[0-9a-f]{32}$/', $row->user_password ) ) {
                        if ( $this->config->get( 'PasswordSalt' ) ) {
 -                              $row->user_password = ":A:{$row->user_id}:{$row->user_password}";
 +                              $row->user_password = ":B:{$row->user_id}:{$row->user_password}";
                        } else {
                                $row->user_password = ":A:{$row->user_password}";
                        }
@@@ -132,12 -132,12 +132,12 @@@
  
                // @codeCoverageIgnoreStart
                if ( $this->getPasswordFactory()->needsUpdate( $pwhash ) ) {
 -                      $pwhash = $this->getPasswordFactory()->newFromPlaintext( $req->password );
 -                      \DeferredUpdates::addCallableUpdate( function () use ( $pwhash, $oldRow ) {
 +                      $newHash = $this->getPasswordFactory()->newFromPlaintext( $req->password );
 +                      \DeferredUpdates::addCallableUpdate( function () use ( $newHash, $oldRow ) {
                                $dbw = wfGetDB( DB_MASTER );
                                $dbw->update(
                                        'user',
 -                                      [ 'user_password' => $pwhash->toString() ],
 +                                      [ 'user_password' => $newHash->toString() ],
                                        [
                                                'user_id' => $oldRow->user_id,
                                                'user_password' => $oldRow->user_password
@@@ -242,14 -242,14 +242,14 @@@
  
                $pwhash = null;
  
-               if ( $this->loginOnly ) {
-                       $pwhash = $this->getPasswordFactory()->newFromCiphertext( null );
-                       $expiry = null;
-                       // @codeCoverageIgnoreStart
-               } elseif ( get_class( $req ) === PasswordAuthenticationRequest::class ) {
-                       // @codeCoverageIgnoreEnd
-                       $pwhash = $this->getPasswordFactory()->newFromPlaintext( $req->password );
-                       $expiry = $this->getNewPasswordExpiry( $username );
+               if ( get_class( $req ) === PasswordAuthenticationRequest::class ) {
+                       if ( $this->loginOnly ) {
+                               $pwhash = $this->getPasswordFactory()->newFromCiphertext( null );
+                               $expiry = null;
+                       } else {
+                               $pwhash = $this->getPasswordFactory()->newFromPlaintext( $req->password );
+                               $expiry = $this->getNewPasswordExpiry( $username );
+                       }
                }
  
                if ( $pwhash ) {

diff --combined tests/phpunit/includes/auth/LocalPasswordPrimaryAuthenticationProviderTest.php
index cb34be2,cab10b4..72a03c3
--- 1/tests/phpunit/includes/auth/LocalPasswordPrimaryAuthenticationProviderTest.php
--- 2/tests/phpunit/includes/auth/LocalPasswordPrimaryAuthenticationProviderTest.php
+++ b/tests/phpunit/includes/auth/LocalPasswordPrimaryAuthenticationProviderTest.php
@@@ -2,8 -2,6 +2,8 @@@
  
  namespace MediaWiki\Auth;
  
 +use MediaWiki\MediaWikiServices;
 +
  /**
   * @group AuthManager
   * @group Database
@@@ -30,7 -28,7 +30,7 @@@ class LocalPasswordPrimaryAuthenticatio
                }
                $config = new \MultiConfig( [
                        $this->config,
 -                      \ConfigFactory::getDefaultInstance()->makeConfig( 'main' )
 +                      MediaWikiServices::getInstance()->getMainConfig()
                ] );
  
                if ( !$this->manager ) {
@@@ -330,6 -328,7 +330,6 @@@
                        AuthenticationResponse::newPass( $userName ),
                        $provider->beginPrimaryAuthentication( $reqs )
                );
 -
        }
  
        /**
@@@ -451,7 -450,7 +451,7 @@@
                $changeReq->password = $newpass;
                $provider->providerChangeAuthenticationData( $changeReq );
  
-               if ( $loginOnly ) {
+               if ( $loginOnly && $changed ) {
                        $old = 'fail';
                        $new = 'fail';
                        $expectExpiry = null;
@@@ -646,6 -645,7 +646,6 @@@
                $this->assertNull( $provider->finishAccountCreation( $user, $user, $res2 ) );
                $ret = $provider->beginPrimaryAuthentication( $reqs );
                $this->assertEquals( AuthenticationResponse::PASS, $ret->status, 'new password is set' );
 -
        }
  
  }