5 * @subpackage SpecialPage
11 function wfSpecialUserlogin() {
12 global $wgCommandLineMode;
14 if( !$wgCommandLineMode && !isset( $_COOKIE[ini_get('session.name')] ) ) {
18 $form = new LoginForm( $wgRequest );
25 * @subpackage SpecialPage
28 var $mName, $mPassword, $mRetype, $mReturnto, $mCookieCheck, $mPosted;
29 var $mAction, $mCreateaccount, $mCreateaccountMail, $mMailmypassword;
30 var $mLoginattempt, $mRemember, $mEmail;
34 * @param webrequest $request A webrequest object passed by reference
36 function LoginForm( &$request ) {
37 global $wgLang, $wgAllowRealName, $wgEnableEmail;
38 global $wgEmailAuthentication;
40 $this->mName
= $request->getText( 'wpName' );
41 $this->mPassword
= $request->getText( 'wpPassword' );
42 $this->mRetype
= $request->getText( 'wpRetype' );
43 $this->mReturnto
= $request->getVal( 'returnto' );
44 $this->mCookieCheck
= $request->getVal( 'wpCookieCheck' );
45 $this->mPosted
= $request->wasPosted();
46 $this->mCreateaccount
= $request->getCheck( 'wpCreateaccount' );
47 $this->mCreateaccountMail
= $request->getCheck( 'wpCreateaccountMail' )
49 $this->mMailmypassword
= $request->getCheck( 'wpMailmypassword' )
51 $this->mLoginattempt
= $request->getCheck( 'wpLoginattempt' );
52 $this->mAction
= $request->getVal( 'action' );
53 $this->mRemember
= $request->getCheck( 'wpRemember' );
55 if( $wgEnableEmail ) {
56 $this->mEmail
= $request->getText( 'wpEmail' );
60 if( $wgAllowRealName ) {
61 $this->mRealName
= $request->getText( 'wpRealName' );
63 $this->mRealName
= '';
66 # When switching accounts, it sucks to get automatically logged out
67 if( $this->mReturnto
== $wgLang->specialPage( 'Userlogout' ) ) {
68 $this->mReturnto
= '';
73 if ( !is_null( $this->mCookieCheck
) ) {
74 $this->onCookieRedirectCheck( $this->mCookieCheck
);
76 } else if( $this->mPosted
) {
77 if( $this->mCreateaccount
) {
78 return $this->addNewAccount();
79 } else if ( $this->mCreateaccountMail
) {
80 return $this->addNewAccountMailPassword();
81 } else if ( $this->mMailmypassword
) {
82 return $this->mailPassword();
83 } else if ( ( 'submitlogin' == $this->mAction
) ||
$this->mLoginattempt
) {
84 return $this->processLogin();
87 $this->mainLoginForm( '' );
93 function addNewAccountMailPassword() {
95 global $wgEmailAuthentication;
97 if ('' == $this->mEmail
) {
98 $this->mainLoginForm( wfMsg( 'noemail', htmlspecialchars( $this->mName
) ) );
102 $u = $this->addNewaccountInternal();
108 $newadr = strtolower($this->mEmail
);
110 # prepare for authentication and mail a temporary password to newadr
111 if ( !$u->isValidEmailAddr( $newadr ) ) {
112 return $this->mainLoginForm( wfMsg( 'invalidemailaddress', $error ) );
114 $u->mEmail
= $newadr; # new behaviour: set this new emailaddr from login-page into user database record
115 $u->mEmailAuthenticationtimestamp
= 0; # but flag as "dirty" = unauthenticated
117 if ($wgEmailAuthentication) {
118 $error = $this->mailPasswordInternal( $u, true, $dummy ); # mail a temporary password to the dirty address
121 $wgOut->setPageTitle( wfMsg( 'accmailtitle' ) );
122 $wgOut->setRobotpolicy( 'noindex,nofollow' );
123 $wgOut->setArticleRelated( false );
125 if ($wgEmailAuthentication) {
127 return $this->mainLoginForm( wfMsg( 'passwordsentforemailauthentication', $u->getName() ) );
129 return $this->mainLoginForm( wfMsg( 'mailerror', $error ) );
131 # if user returns, that new email address gets authenticated in checkpassword()
133 # if ( $error === '' ) {
134 # $wgOut->addWikiText( wfMsg( 'accmailtext', $u->getName(), $u->getEmail() ) );
135 # $wgOut->returnToMain( false );
137 # $this->mainLoginForm( wfMsg( 'mailerror', $error ) );
146 function addNewAccount() {
147 global $wgUser, $wgOut;
148 global $wgEmailAuthentication;
150 $u = $this->addNewAccountInternal();
156 $newadr = strtolower($this->mEmail
);
157 if ($newadr != '') { # prepare for authentication and mail a temporary password to newadr
158 if ( !$u->isValidEmailAddr( $newadr ) ) {
159 return $this->mainLoginForm( wfMsg( 'invalidemailaddress', $error ) );
161 $u->mEmail
= $newadr; # new behaviour: set this new emailaddr from login-page into user database record
162 $u->mEmailAuthenticationtimestamp
= 0; # but flag as "dirty" = unauthenticated
164 if ($wgEmailAuthentication) {
165 # mail a temporary password to the dirty address
167 $error = $this->mailPasswordInternal( $u, true, $dummy );
169 return $this->mainLoginForm( wfMsg( 'passwordsentforemailauthentication', $u->getName() ) );
171 return $this->mainLoginForm( wfMsg( 'mailerror', $error ) );
173 # if user returns, that new email address gets authenticated in checkpassword()
178 $wgUser->setCookies();
180 $wgUser->saveSettings();
182 if( $this->hasSessionCookie() ) {
183 return $this->successfulLogin( wfMsg( 'welcomecreation', $wgUser->getName() ) );
185 return $this->cookieRedirectCheck( 'new' );
192 function addNewAccountInternal() {
193 global $wgUser, $wgOut;
194 global $wgMaxNameChars, $wgUseLatin1;
195 global $wgMemc, $wgAccountCreationThrottle, $wgDBname, $wgIP;
196 global $wgMinimalPasswordLength;
198 if (!$wgUser->isAllowedToCreateAccount()) {
199 $this->userNotPrivilegedMessage();
203 if ( 0 != strcmp( $this->mPassword
, $this->mRetype
) ) {
204 $this->mainLoginForm( wfMsg( 'badretype' ) );
208 $name = trim( $this->mName
);
209 $u = User
::newFromName( $name );
210 if ( is_null( $u ) ||
212 $wgUser->isIP( $name ) ||
213 (strpos( $name, '/' ) !== false) ||
214 (strlen( $name ) > $wgMaxNameChars) ||
215 ($wgUseLatin1 && preg_match( "/[\x80-\xA0]/", $name )) ||
216 ucFirst($name) != $u->getName() )
218 $this->mainLoginForm( wfMsg( 'noname' ) );
221 if ( wfReadOnly() ) {
222 $wgOut->readOnlyPage();
226 if ( 0 != $u->idForName() ) {
227 $this->mainLoginForm( wfMsg( 'userexists' ) );
231 if ( strlen( $this->mPassword
) < $wgMinimalPasswordLength ) {
232 $this->mainLoginForm( wfMsg( 'passwordtooshort', $wgMinimalPasswordLength ) );
236 if ( $wgAccountCreationThrottle ) {
237 $key = $wgDBname.':acctcreate:ip:'.$wgIP;
238 $value = $wgMemc->incr( $key );
240 $wgMemc->set( $key, 1, 86400 );
242 if ( $value > $wgAccountCreationThrottle ) {
243 $this->throttleHit( $wgAccountCreationThrottle );
248 return $this->initUser( $u );
252 * Actually add a user to the database.
253 * Give it a User object that has been initialised with a name.
259 function &initUser( &$u ) {
261 $u->setPassword( $this->mPassword
);
262 $u->setEmail( $this->mEmail
);
263 $u->setRealName( $this->mRealName
);
267 $wgAuth->initUser( $u );
269 if ( $this->mRemember
) { $r = 1; }
271 $u->setOption( 'rememberpassword', $r );
279 function processLogin() {
280 global $wgUser, $wgLang;
281 global $wgEmailAuthentication;
283 if ( '' == $this->mName
) {
284 $this->mainLoginForm( wfMsg( 'noname' ) );
287 $u = User
::newFromName( $this->mName
);
288 if( is_null( $u ) ) {
289 $this->mainLoginForm( wfMsg( 'noname' ) );
292 if ( 0 == $u->getID() ) {
295 * If the external authentication plugin allows it,
296 * automatically create a new account for users that
297 * are externally defined but have not yet logged in.
299 if ( $wgAuth->autoCreate() && $wgAuth->userExists( $u->getName() ) ) {
300 if ( $wgAuth->authenticate( $u->getName(), $this->mPassword
) ) {
301 $u =& $this->initUser( $u );
303 $this->mainLoginForm( wfMsg( 'wrongpassword' ) );
307 $this->mainLoginForm( wfMsg( 'nosuchuser', $u->getName() ) );
311 $u->loadFromDatabase();
314 # store temporarily the status before the password check is performed
316 $oldadr = strtolower($u->getEmail());
317 $newadr = strtolower($this->mEmail
);
318 $alreadyauthenticated = (( $u->mEmailAuthenticationtimestamp
!= 0 ) ||
($oldadr == '')) ;
320 # checkPassword sets EmailAuthenticationtimestamp, if the newPassword is used
322 if (!$u->checkPassword( $this->mPassword
)) {
323 $this->mainLoginForm( wfMsg( 'wrongpassword' ) );
327 # We've verified now, update the real record
329 if ( $this->mRemember
) {
334 $u->setOption( 'rememberpassword', $r );
336 /* check if user with correct password has entered a new email address */
337 if (($newadr <> '') && ($newadr <> $oldadr)) { # the user supplied a new email address on the login page
339 # prepare for authentication and mail a temporary password to newadr
340 if ( !$u->isValidEmailAddr( $newadr ) ) {
341 return $this->mainLoginForm( wfMsg( 'invalidemailaddress', $error ) );
343 $u->mEmail
= $newadr; # new behaviour: store this new emailaddr from login-page now into user database record ...
344 $u->mEmailAuthenticationtimestamp
= 0; # ... but flag the address as "dirty" (unauthenticated)
345 $alreadyauthenticated = false;
347 if ($wgEmailAuthentication) {
349 # mail a temporary one-time password to the dirty address and return here to complete the user login
350 # if the user returns now or later using this temp. password, then the new email address $newadr
351 # - which is already stored in his user record - gets authenticated in checkpassword()
353 $error = $this->mailPasswordInternal( $u, false, $newpassword_temp);
354 $u->mNewpassword
= $newpassword_temp;
356 # The temporary password is mailed. The user is logged-in as he entered his correct password
357 # This appears to be more intuitive than alternative 2.
360 $mailmsg = '<br />' . wfMsg( 'passwordsentforemailauthentication', $u->getName() );
362 $mailmsg = '<br />' . wfMsg( 'mailerror', $error ) ;
368 $wgUser->setCookies();
370 # save all settings (incl. new email address and/or temporary password, if applicable)
371 $wgUser->saveSettings();
373 if ( !$wgEmailAuthentication ||
$alreadyauthenticated ) {
376 } elseif ($u->mEmailAuthenticationtimestamp
!= 0) {
377 $authenticated = ' ' . wfMsg( 'emailauthenticated', $wgLang->timeanddate( $u->mEmailAuthenticationtimestamp
, true ) );
379 $authenticated = ' ' . wfMsg( 'emailnotauthenticated' );
382 if( $this->hasSessionCookie() ) {
383 return $this->successfulLogin( wfMsg( 'loginsuccess', $wgUser->getName() ) . $authenticated . $mailmsg );
385 return $this->cookieRedirectCheck( 'login' );
392 function mailPassword() {
393 global $wgUser, $wgDeferredUpdateList, $wgOutputEncoding;
394 global $wgCookiePath, $wgCookieDomain, $wgDBname;
396 if ( '' == $this->mName
) {
397 $this->mainLoginForm( wfMsg( 'noname' ) );
400 $u = User
::newFromName( $this->mName
);
401 if( is_null( $u ) ) {
402 $this->mainLoginForm( wfMsg( 'noname' ) );
405 if ( 0 == $u->getID() ) {
406 $this->mainLoginForm( wfMsg( 'nosuchuser', $u->getName() ) );
410 $u->loadFromDatabase();
412 $error = $this->mailPasswordInternal( $u, true, $dummy );
414 $this->mainLoginForm( wfMsg( 'passwordsent', $u->getName() ) );
416 $this->mainLoginForm( wfMsg( 'mailerror', $error ) );
425 function mailPasswordInternal( $u, $savesettings = true, &$newpassword_out ) {
426 global $wgPasswordSender, $wgDBname, $wgIP;
427 global $wgCookiePath, $wgCookieDomain;
429 if ( '' == $u->getEmail() ) {
430 return wfMsg( 'noemail', $u->getName() );
433 $np = $u->randomPassword();
434 $u->setNewpassword( $np );
436 # we want to store this new password together with other values in the calling function
437 $newpassword_out = $u->mNewpassword
;
439 # WHY IS THIS HERE ? SHOULDN'T IT BE User::setcookie ???
440 setcookie( "{$wgDBname}Token", '', time() - 3600, $wgCookiePath, $wgCookieDomain );
447 if ( '' == $ip ) { $ip = '(Unknown)'; }
449 $m = wfMsg( 'passwordremindermailbody', $ip, $u->getName(), wfUrlencode($u->getName()), $np );
451 require_once('UserMailer.php');
452 $error = userMailer( $u->getEmail(), $wgPasswordSender, wfMsg( 'passwordremindermailsubject' ), $m );
454 return htmlspecialchars( $error );
459 * @param string $msg Message that will be shown on success.
462 function successfulLogin( $msg ) {
466 # Run any hooks; ignore results
468 wfRunHooks('UserLoginComplete', array(&$wgUser));
470 $wgOut->setPageTitle( wfMsg( 'loginsuccesstitle' ) );
471 $wgOut->setRobotpolicy( 'noindex,nofollow' );
472 $wgOut->setArticleRelated( false );
473 $wgOut->addWikiText( $msg );
474 $wgOut->returnToMain();
478 function userNotPrivilegedMessage() {
481 $wgOut->setPageTitle( wfMsg( 'whitelistacctitle' ) );
482 $wgOut->setRobotpolicy( 'noindex,nofollow' );
483 $wgOut->setArticleRelated( false );
485 $wgOut->addWikiText( wfMsg( 'whitelistacctext' ) );
487 $wgOut->returnToMain( false );
493 function mainLoginForm( $err ) {
494 global $wgUser, $wgOut, $wgLang;
495 global $wgDBname, $wgAllowRealName, $wgEnableEmail;
496 global $wgEmailAuthentication;
498 if ( '' == $this->mName
) {
499 if ( $wgUser->isLoggedIn() ) {
500 $this->mName
= $wgUser->getName();
502 $this->mName
= @$_COOKIE[$wgDBname.'UserName'];
506 $q = 'action=submitlogin';
507 if ( !empty( $this->mReturnto
) ) {
508 $q .= '&returnto=' . wfUrlencode( $this->mReturnto
);
510 $titleObj = Title
::makeTitle( NS_SPECIAL
, 'Userlogin' );
512 require_once( 'templates/Userlogin.php' );
513 $template =& new UserloginTemplate();
515 $template->set( 'name', $this->mName
);
516 $template->set( 'password', $this->mPassword
);
517 $template->set( 'retype', $this->mRetype
);
518 $template->set( 'email', $this->mEmail
);
519 $template->set( 'realname', $this->mRealName
);
521 $template->set( 'action', $titleObj->getLocalUrl( $q ) );
522 $template->set( 'error', $err );
523 $template->set( 'create', $wgUser->isAllowedToCreateAccount() );
524 $template->set( 'createemail', $wgEnableEmail && $wgUser->isLoggedIn() );
525 $template->set( 'userealname', $wgAllowRealName );
526 $template->set( 'useemail', $wgEnableEmail );
527 $template->set( 'useemailauthent', $wgEmailAuthentication );
528 $template->set( 'remember', $wgUser->getOption( 'rememberpassword' ) or $this->mRemember
);
530 $wgOut->setPageTitle( wfMsg( 'userlogin' ) );
531 $wgOut->setRobotpolicy( 'noindex,nofollow' );
532 $wgOut->setArticleRelated( false );
533 $wgOut->addTemplate( $template );
539 function hasSessionCookie() {
540 global $wgDisableCookieCheck;
541 return ( $wgDisableCookieCheck ) ?
true : ( '' != $_COOKIE[session_name()] );
547 function cookieRedirectCheck( $type ) {
548 global $wgOut, $wgLang;
550 $titleObj = Title
::makeTitle( NS_SPECIAL
, 'Userlogin' );
551 $check = $titleObj->getFullURL( 'wpCookieCheck='.$type );
553 return $wgOut->redirect( $check );
559 function onCookieRedirectCheck( $type ) {
562 if ( !$this->hasSessionCookie() ) {
563 if ( $type == 'new' ) {
564 return $this->mainLoginForm( wfMsg( 'nocookiesnew' ) );
565 } else if ( $type == 'login' ) {
566 return $this->mainLoginForm( wfMsg( 'nocookieslogin' ) );
569 return $this->mainLoginForm( wfMsg( 'error' ) );
572 return $this->successfulLogin( wfMsg( 'loginsuccess', $wgUser->getName() ) );
579 function throttleHit( $limit ) {
582 $wgOut->addWikiText( wfMsg( 'acct_creation_throttle_hit', $limit ) );