AbortChangePassword.patch
Public
Actions

Authored By

	• bzimport
	Nov 22 2014, 1:21 AM

Size

4 KB

Referenced Files

None

Subscribers

None

AbortChangePassword.patch
View Options

	From 605dc1060554d272709a3c0c91030e358a5e7770 Mon Sep 17 00:00:00 2001
	From: Ryan Lane <rlane@wikimedia.org>
	Date: Wed, 27 Mar 2013 01:10:40 -0400
	Subject: [PATCH] Add hook AbortChangePassword to Special:ChangePassword

	Adds a consistent method for authentication extensions to block
	password changing operations.

	Change-Id: I3469e90a958c4fb0f24cafd67de5590d3cc2f075
	---
	RELEASE-NOTES-1.21 \| 2 ++
	docs/hooks.txt \| 6 ++++++
	includes/specials/SpecialChangePassword.php \| 6 ++++++
	languages/messages/MessagesEn.php \| 1 +
	languages/messages/MessagesQqq.php \| 1 +
	5 files changed, 16 insertions(+), 0 deletions(-)

	diff --git a/RELEASE-NOTES-1.21 b/RELEASE-NOTES-1.21
	index 8844f9b..b3ad623 100644
	--- a/RELEASE-NOTES-1.21
	+++ b/RELEASE-NOTES-1.21
	@@ -210,6 +210,8 @@ production.
	* (bug 45143) jquery.badge: Treat non-Latin variants of zero as zero as well.
	* (bug 46151) mwdocgen.php should not ignore exit code of doxygen command.
	* (bug 41889) Fix $.tablesorter rowspan exploding for complex cases.
	+* Added AbortChangePassword hook to allow extensions to abort password changes from
	+ Special:ChangePassword

	=== API changes in 1.21 ===
	* prop=revisions can now report the contentmodel and contentformat.
	diff --git a/docs/hooks.txt b/docs/hooks.txt
	index c266dcc..93d222e 100644
	--- a/docs/hooks.txt
	+++ b/docs/hooks.txt
	@@ -270,6 +270,12 @@ $reason: the reason for the move (added in 1.13)
	$user: the User object about to be created (read-only, incomplete)
	&$msg: out parameter: HTML to display on abort

	+'AbortChangePassword': Return false to cancel password change.
	+$user: the User object to which the password change is occuring
	+$this->mOldpass: the old password provided by the user
	+$newpass: the new password provided by the user
	+&$abortMsg: the message identifier for abort reason
	+
	'ActionBeforeFormDisplay': Before executing the HTMLForm object.
	$name: name of the action
	&$form: HTMLForm object
	diff --git a/includes/specials/SpecialChangePassword.php b/includes/specials/SpecialChangePassword.php
	index 73eb97f..e538cac 100644
	--- a/includes/specials/SpecialChangePassword.php
	+++ b/includes/specials/SpecialChangePassword.php
	@@ -243,6 +243,12 @@ class SpecialChangePassword extends UnlistedSpecialPage {
	throw new PasswordError( $this->msg( 'login-throttled' )->text() );
	}

	+ $abortMsg = 'resetpass-abort-generic';
	+ if ( !wfRunHooks( 'AbortChangePassword', array( $user, $this->mOldpass, $newpass, &$abortMsg ) ) ) {
	+ wfRunHooks( 'PrefsPasswordAudit', array( $user, $newpass, 'abortreset' ) );
	+ throw new PasswordError( $this->msg( $abortMsg )->text() );
	+ }
	+
	if( !$user->checkTemporaryPassword( $this->mOldpass ) && !$user->checkPassword( $this->mOldpass ) ) {
	wfRunHooks( 'PrefsPasswordAudit', array( $user, $newpass, 'wrongpassword' ) );
	throw new PasswordError( $this->msg( 'resetpass-wrong-oldpass' )->text() );
	diff --git a/languages/messages/MessagesEn.php b/languages/messages/MessagesEn.php
	index adac7e9..937e25f 100644
	--- a/languages/messages/MessagesEn.php
	+++ b/languages/messages/MessagesEn.php
	@@ -1205,6 +1205,7 @@ To finish logging in, you must set a new password here:',
	'oldpassword' => 'Old password:',
	'newpassword' => 'New password:',
	'retypenew' => 'Retype new password:',
	+'resetpass-abort-generic' => 'Password change has been aborted by an extension.',
	'resetpass_submit' => 'Set password and log in',
	'resetpass_success' => 'Your password has been changed successfully!
	Now logging you in...',
	diff --git a/languages/messages/MessagesQqq.php b/languages/messages/MessagesQqq.php
	index 6644cf9..090f4f6 100644
	--- a/languages/messages/MessagesQqq.php
	+++ b/languages/messages/MessagesQqq.php
	@@ -1208,6 +1208,7 @@ See also:
	'oldpassword' => "Used on the 'User profile' tab of 'my preferences'. This is the text next to an entry box for the old password in the 'change password' section.",
	'newpassword' => '{{Identical\|New password}}',
	'retypenew' => "Appears on the 'User profile' tab of the 'Preferences' special page in the 'Change password' section. It appears next to the text box for entering the new password a second time.",
	+'resetpass-abort-generic' => 'Generic error message shown on [[Special:ChangePassword]] when an extension aborts a password change from a hook.',
	'resetpass_submit' => 'Submit button on [[Special:ChangePassword]]',
	'resetpass_success' => 'Used in [[Special:ChangePassword]].',
	'resetpass_forbidden' => "Used as error message in changing password. Maybe the external auth plugin won't allow local password changes.",
	--
	1.7.6.1

File Metadata

Mime Type: text/x-diff
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 9949
Default Alt Text: AbortChangePassword.patch (4 KB)

AbortChangePassword.patchPublicActions

AbortChangePassword.patchView Options

File Metadata

Event Timeline

AbortChangePassword.patch
Public
Actions

AbortChangePassword.patch
View Options