Merge branch 'master' of git://github.com/gallery/gallery3

20 files changed, 219 insertions, 97 deletions

diff --git a/lib/gallery.in_place_edit.js b/lib/gallery.in_place_edit.js
index c10400e3..5a815dac 100644
--- a/lib/gallery.in_place_edit.js
+++ b/lib/gallery.in_place_edit.js
@@ -10,10 +10,10 @@
      },
 
      _show: function(target) {
-       if ($(this).data("gallery_in_place_edit") == true) {
+       if ($(target).data("gallery_in_place_edit") == true) {
          return;
        }
-       $(this).data("gallery_in_place_edit", true);
+       $(target).data("gallery_in_place_edit", true);
        var self = this;
        var tag_width = $(target).width();
        $(self).data("tag_width", tag_width);
@@ -27,26 +27,28 @@
          var parent = $(target).parent();
          parent.children().hide();
          parent.append(data);
-         parent.find("form :text")
-           .width(tag_width)
-           .focus();
-         $(".g-short-form").gallery_short_form();
-         parent.find("form .g-cancel").click(function(event) {
-           self._cancel();
-           event.preventDefault();
-           return false;
-         });
-         self._ajaxify_edit();
+         self._setup_form(parent.find("form"));
        });
+     },
 
+     _setup_form: function(form) {
+       var self = this;
+       var width = $(self).data("tag_width");
+       form.find(":text").width(width).focus();
+       form.find(".g-cancel").click(function(event) {
+         self._cancel();
+         event.preventDefault();
+         return false;
+       });
+       $(".g-short-form").gallery_short_form();
+       this._ajaxify_edit();
      },
 
      _cancel: function() {
        var parent = $("#g-in-place-edit-form").parent();
-       $(parent).find("form").remove();
+       $("#g-in-place-edit-form").remove();
        $(parent).children().show();
-       $("#g-in-place-edit-message").remove();
-       $(this).data("gallery_in_place_edit", false);
+       $(parent).find(".g-editable").data("gallery_in_place_edit", false);
      },
 
      _ajaxify_edit: function() {
@@ -60,17 +62,7 @@
            } else {
              var parent = $(form).parent();
              $(form).replaceWith(data.form);
-             var width = $(self).data("tag_width");
-             $(parent).find("form :text")
-               .width(width)
-               .focus();
-             $(".g-short-form").gallery_short_form();
-             $(parent).find("form .g-cancel").click(function(event) {
-               self._cancel();
-               event.preventDefault();
-               return false;
-             });
-             self._ajaxify_edit();
+             self._setup_form(parent.find("form"));
            }
          }
        });
diff --git a/modules/gallery/controllers/admin_maintenance.php b/modules/gallery/controllers/admin_maintenance.php
index 3062ea09..8e4845a9 100644
--- a/modules/gallery/controllers/admin_maintenance.php
+++ b/modules/gallery/controllers/admin_maintenance.php
@@ -46,6 +46,15 @@ class Admin_Maintenance_Controller extends Admin_Controller {
       ->where("done", "=", 0)->order_by("updated", "DESC")->find_all();
     $view->content->finished_tasks = ORM::factory("task")
       ->where("done", "=", 1)->order_by("updated", "DESC")->find_all();
+    $task_buttons =
+      new ArrayObject(array((object)array("text" => t("run"),
+                                          "url" =>url::site("admin/maintenance/start"))));
+    module::event("admin_maintenance_task_buttons", $task_buttons);
+    $view->content->task_buttons = $task_buttons;
+
+    $maintenance_content = new ArrayObject();
+    module::event("admin_maintenance_content", $maintenance_content);
+    $view->content->task_maintenance_content = $maintenance_content;
     print $view;
   }
 
@@ -56,13 +65,10 @@ class Admin_Maintenance_Controller extends Admin_Controller {
   public function start($task_callback) {
     access::verify_csrf();
 
-    $tasks = task::get_definitions();
-    $task = task::create($tasks[$task_callback], array());
+    $task = task::start($task_callback);
     $view = new View("admin_maintenance_task.html");
     $view->task = $task;
 
-    $task->log(t("Task %task_name started (task id %task_id)",
-                         array("task_name" => $task->name, "task_id" => $task->id)));
     log::info("tasks", t("Task %task_name started (task id %task_id)",
                          array("task_name" => $task->name, "task_id" => $task->id)),
               html::anchor("admin/maintenance", t("maintenance")));
diff --git a/modules/gallery/css/l10n_client.css b/modules/gallery/css/l10n_client.css
index 053b4432..90034d0c 100644
--- a/modules/gallery/css/l10n_client.css
+++ b/modules/gallery/css/l10n_client.css
@@ -45,7 +45,6 @@
   display:block;
   position:absolute; right:0em;
   height:2em; line-height:2em;
-  text-transform:uppercase;
   text-align:center; background:#000;
 }
 #l10n-client-toggler a {
@@ -62,7 +61,7 @@
   height:1em; line-height:1em;
   padding: .5em; margin:0px;
   font-size:1em;
-  text-transform:uppercase;}
+}
 
 #l10n-client .strings h2 {
   border:0px;}
diff --git a/modules/gallery/helpers/album.php b/modules/gallery/helpers/album.php
index 389f6e48..15e0c3ca 100644
--- a/modules/gallery/helpers/album.php
+++ b/modules/gallery/helpers/album.php
@@ -36,7 +36,8 @@ class album_Core {
     $group->input("name")->label(t("Directory name"))
       ->error_messages("no_slashes", t("The directory name can't contain the \"/\" character"))
       ->error_messages("required", t("You must provide a directory name"))
-      ->error_messages("length", t("Your directory name is too long"));
+      ->error_messages("length", t("Your directory name is too long"))
+      ->error_messages("conflict", t("There is already a movie, photo or album with this name"));
     $group->input("slug")->label(t("Internet Address"))
       ->error_messages(
         "not_url_safe",
@@ -51,7 +52,8 @@ class album_Core {
   }
 
   static function get_edit_form($parent) {
-    $form = new Forge("albums/update/{$parent->id}", "", "post", array("id" => "g-edit-album-form"));
+    $form = new Forge(
+      "albums/update/{$parent->id}", "", "post", array("id" => "g-edit-album-form"));
     $form->hidden("from_id");
     $group = $form->group("edit_item")->label(t("Edit Album"));
 
@@ -61,8 +63,7 @@ class album_Core {
     $group->textarea("description")->label(t("Description"))->value($parent->description);
     if ($parent->id != 1) {
       $group->input("name")->label(t("Directory Name"))->value($parent->name)
-        ->error_messages(
-          "conflict", t("There is already a movie, photo or album with this name"))
+        ->error_messages("conflict", t("There is already a movie, photo or album with this name"))
         ->error_messages("no_slashes", t("The directory name can't contain a \"/\""))
         ->error_messages("no_trailing_period", t("The directory name can't end in \".\""))
         ->error_messages("required", t("You must provide a directory name"))
diff --git a/modules/gallery/helpers/auth.php b/modules/gallery/helpers/auth.php
index 16f8915a..717cf40a 100644
--- a/modules/gallery/helpers/auth.php
+++ b/modules/gallery/helpers/auth.php
@@ -78,10 +78,16 @@ class auth_Core {
     }
   }
 
+  static function validate_too_many_failed_password_changes($password_input) {
+    if (self::too_many_failed_logins(identity::active_user()->name)) {
+      $password_input->add_error("too_many_failed_password_changes", 1);
+    }
+  }
+
   /**
    * Record a failed login for this user
    */
-  static function record_failed_login($name) {
+  static function record_failed_auth_attempts($name) {
     $failed_login = ORM::factory("failed_login")
       ->where("name", "=", $name)
       ->find();
@@ -96,7 +102,7 @@ class auth_Core {
   /**
    * Clear any failed logins for this user
    */
-  static function record_successful_login($user) {
+  static function clear_failed_logins($user) {
     db::build()
       ->delete("failed_logins")
       ->where("name", "=", $user->name)
diff --git a/modules/gallery/helpers/gallery_event.php b/modules/gallery/helpers/gallery_event.php
index 6479e2c3..7b538c49 100644
--- a/modules/gallery/helpers/gallery_event.php
+++ b/modules/gallery/helpers/gallery_event.php
@@ -110,11 +110,19 @@ class gallery_event_Core {
       graphics::choose_default_toolkit();
       module::clear_var("gallery", "choose_default_tookit");
     }
-    auth::record_successful_login($user);
+    auth::clear_failed_auth_attempts($user);
   }
 
   static function user_login_failed($name) {
-    auth::record_failed_login($name);
+    auth::record_failed_auth_attempts($name);
+  }
+
+  static function user_password_changed($user) {
+    auth::clear_failed_auth_attempts($user);
+  }
+
+  static function user_password_change_failed($name) {
+    auth::record_failed_auth_attempts($name);
   }
 
   static function item_index_data($item, $data) {
diff --git a/modules/gallery/helpers/gallery_installer.php b/modules/gallery/helpers/gallery_installer.php
index bffef8e6..761843b0 100644
--- a/modules/gallery/helpers/gallery_installer.php
+++ b/modules/gallery/helpers/gallery_installer.php
@@ -287,7 +287,7 @@ class gallery_installer {
     // @todo this string needs to be picked up by l10n_scanner
     module::set_var("gallery", "credits", "Powered by <a href=\"%url\">Gallery %version</a>");
     module::set_var("gallery", "simultaneous_upload_limit", 5);
-    module::set_version("gallery", 25);
+    module::set_version("gallery", 26);
   }
 
   static function upgrade($version) {
@@ -514,6 +514,18 @@ class gallery_installer {
       }
       module::set_version("gallery", $version = 25);
     }
+
+    if ($version == 25) {
+      db::build()
+        ->update("items")
+        ->set("title", new Database_Expression("`name`"))
+        ->and_open()
+        ->where("title", "IS", null)
+        ->or_where("title", "=", "")
+        ->close()
+        ->execute();
+      module::set_version("gallery", $version = 26);
+    }
   }
 
   static function uninstall() {
diff --git a/modules/gallery/helpers/task.php b/modules/gallery/helpers/task.php
index 645850d1..aa0eb94d 100644
--- a/modules/gallery/helpers/task.php
+++ b/modules/gallery/helpers/task.php
@@ -35,6 +35,15 @@ class task_Core {
     return $tasks;
   }
 
+  static function start($task_callback, $context=array()) {
+    $tasks = task::get_definitions();
+    $task = task::create($tasks[$task_callback], array());
+
+    $task->log(t("Task %task_name started (task id %task_id)",
+                 array("task_name" => $task->name, "task_id" => $task->id)));
+    return $task;
+  }
+
   static function create($task_def, $context) {
     $task = ORM::factory("task");
     $task->callback = $task_def->callback;
diff --git a/modules/gallery/module.info b/modules/gallery/module.info
index 50a1505f..fd241066 100644
--- a/modules/gallery/module.info
+++ b/modules/gallery/module.info
@@ -1,3 +1,3 @@
 name = "Gallery 3"
 description = "Gallery core application"
-version = 25
+version = 26
diff --git a/modules/gallery/tests/xss_data.txt b/modules/gallery/tests/xss_data.txt
index 65b45a08..e53502ee 100644
--- a/modules/gallery/tests/xss_data.txt
+++ b/modules/gallery/tests/xss_data.txt
@@ -81,18 +81,19 @@ modules/gallery/views/admin_maintenance.html.php             24  DIRTY_ATTR log:
 modules/gallery/views/admin_maintenance.html.php             25  DIRTY_ATTR log::severity_class($task->severity)
 modules/gallery/views/admin_maintenance.html.php             26  DIRTY    $task->name
 modules/gallery/views/admin_maintenance.html.php             29  DIRTY    $task->description
-modules/gallery/views/admin_maintenance.html.php             70  DIRTY_ATTR text::alternate("g-odd","g-even")
-modules/gallery/views/admin_maintenance.html.php             70  DIRTY_ATTR $task->state=="stalled"?"g-warning":""
-modules/gallery/views/admin_maintenance.html.php             71  DIRTY_ATTR $task->state=="stalled"?"g-warning":""
-modules/gallery/views/admin_maintenance.html.php             72  DIRTY    gallery::date_time($task->updated)
-modules/gallery/views/admin_maintenance.html.php             75  DIRTY    $task->name
-modules/gallery/views/admin_maintenance.html.php             90  DIRTY    $task->status
-modules/gallery/views/admin_maintenance.html.php             141 DIRTY_ATTR text::alternate("g-odd","g-even")
-modules/gallery/views/admin_maintenance.html.php             141 DIRTY_ATTR $task->state=="success"?"g-success":"g-error"
-modules/gallery/views/admin_maintenance.html.php             142 DIRTY_ATTR $task->state=="success"?"g-success":"g-error"
-modules/gallery/views/admin_maintenance.html.php             143 DIRTY    gallery::date_time($task->updated)
-modules/gallery/views/admin_maintenance.html.php             146 DIRTY    $task->name
-modules/gallery/views/admin_maintenance.html.php             158 DIRTY    $task->status
+modules/gallery/views/admin_maintenance.html.php             33  DIRTY_JS "{$button->url}/$task->callback?csrf=$csrf"
+modules/gallery/views/admin_maintenance.html.php             76  DIRTY_ATTR text::alternate("g-odd","g-even")
+modules/gallery/views/admin_maintenance.html.php             76  DIRTY_ATTR $task->state=="stalled"?"g-warning":""
+modules/gallery/views/admin_maintenance.html.php             77  DIRTY_ATTR $task->state=="stalled"?"g-warning":""
+modules/gallery/views/admin_maintenance.html.php             78  DIRTY    gallery::date_time($task->updated)
+modules/gallery/views/admin_maintenance.html.php             81  DIRTY    $task->name
+modules/gallery/views/admin_maintenance.html.php             96  DIRTY    $task->status
+modules/gallery/views/admin_maintenance.html.php             147 DIRTY_ATTR text::alternate("g-odd","g-even")
+modules/gallery/views/admin_maintenance.html.php             147 DIRTY_ATTR $task->state=="success"?"g-success":"g-error"
+modules/gallery/views/admin_maintenance.html.php             148 DIRTY_ATTR $task->state=="success"?"g-success":"g-error"
+modules/gallery/views/admin_maintenance.html.php             149 DIRTY    gallery::date_time($task->updated)
+modules/gallery/views/admin_maintenance.html.php             152 DIRTY    $task->name
+modules/gallery/views/admin_maintenance.html.php             164 DIRTY    $task->status
 modules/gallery/views/admin_maintenance_show_log.html.php    8   DIRTY_JS url::site("admin/maintenance/save_log/$task->id?csrf=$csrf")
 modules/gallery/views/admin_maintenance_show_log.html.php    13  DIRTY    $task->name
 modules/gallery/views/admin_maintenance_task.html.php        55  DIRTY    $task->name
diff --git a/modules/gallery/views/admin_advanced_settings.html.php b/modules/gallery/views/admin_advanced_settings.html.php
index 2d4b11a1..1f7d2f64 100644
--- a/modules/gallery/views/admin_advanced_settings.html.php
+++ b/modules/gallery/views/admin_advanced_settings.html.php
@@ -25,10 +25,10 @@
           <a href="<?= url::site("admin/advanced_settings/edit/$var->module_name/" . html::clean($var->name)) ?>"
             class="g-dialog-link"
             title="<?= t("Edit %var (%module_name)", array("var" => $var->name, "module_name" => $var->module_name))->for_html_attr() ?>">
-            <? if (isset($var->value)): ?>
-            <?= html::clean($var->value) ?>
-            <? else: ?>
+            <? if (!isset($var->value) || $var->value === ""): ?>
             <i> <?= t("empty") ?> </i>
+            <? else: ?>
+            <?= html::clean($var->value) ?>
             <? endif ?>
         </a>
         </td>
diff --git a/modules/gallery/views/admin_maintenance.html.php b/modules/gallery/views/admin_maintenance.html.php
index ac597715..19375670 100644
--- a/modules/gallery/views/admin_maintenance.html.php
+++ b/modules/gallery/views/admin_maintenance.html.php
@@ -29,16 +29,22 @@
             <?= $task->description ?>
           </td>
           <td>
-            <a href="<?= url::site("admin/maintenance/start/$task->callback?csrf=$csrf") ?>"
+            <? foreach ($task_buttons as $button): ?>
+            <a href="<?= "{$button->url}/$task->callback?csrf=$csrf" ?>"
               class="g-dialog-link g-button ui-icon-left ui-state-default ui-corner-all">
-              <?= t("run") ?>
+              <?= html::clean($button->text) ?>
             </a>
+            <? endforeach ?>
           </td>
         </tr>
         <? endforeach ?>
       </table>
     </div>
 
+    <? foreach ($task_maintenance_content as $content): ?>
+    <?= html::purify($content) ?>
+    <? endforeach ?>
+
     <? if ($running_tasks->count()): ?>
     <div id="g-running-tasks">
       <h2> <?= t("Running tasks") ?> </h2>
diff --git a/modules/gallery/views/in_place_edit.html.php b/modules/gallery/views/in_place_edit.html.php
index 05a16ad4..2d6cbe90 100644
--- a/modules/gallery/views/in_place_edit.html.php
+++ b/modules/gallery/views/in_place_edit.html.php
@@ -9,7 +9,13 @@
       <?= form::submit(array("class" => "submit ui-state-default"), t("Save")) ?>
     </li>
     <li><a href="#" class="g-cancel"><?= t("Cancel") ?></a></li>
+    <? if (!empty($errors["input"])): ?>
+    <li>
+      <p id="g-in-place-edit-message" class="g-error"><?= $errors["input"] ?></p>
+    </li>
+    <? endif ?>
   </ul>
 </form>
 
 
+
diff --git a/modules/gallery/views/user_profile.html.php b/modules/gallery/views/user_profile.html.php
index f35f8c3f..78e1c579 100644
--- a/modules/gallery/views/user_profile.html.php
+++ b/modules/gallery/views/user_profile.html.php
@@ -57,13 +57,16 @@
     </a>
     <? endif ?>
     <? if ($editable): ?>
-       <a class="g-button ui-icon-right ui-state-default ui-corner-all g-dialog-link" href="<?= url::site("form/edit/users/{$user->id}") ?>">
+    <a class="g-button ui-icon-right ui-state-default ui-corner-all g-dialog-link" href="<?= url::site("form/edit/users/{$user->id}") ?>">
       <?= t("Edit") ?>
     </a>
+    <a class="g-button ui-icon-right ui-state-default ui-corner-all g-dialog-link" href="<?= url::site("users/form_change_password/{$user->id}") ?>">
+      <?= t("Change password") ?>
+    </a>
     <? endif ?>
 
     <a id="g-profile-return" class="g-button ui-icon-right ui-state-default ui-corner-all" href="#">
       <?= t("Return") ?>
     </a>
   </div>
-</div>
\ No newline at end of file
+</div>
diff --git a/modules/rss/views/feed.mrss.php b/modules/rss/views/feed.mrss.php
index a61ee96c..cdb4f0f0 100644
--- a/modules/rss/views/feed.mrss.php
+++ b/modules/rss/views/feed.mrss.php
@@ -1,5 +1,5 @@
 <?php defined("SYSPATH") or die("No direct script access.") ?>
-<? echo "<?xml version=\"1.0\" ?>" ?>
+<? echo '<?xml version="1.0" ?>' ?>
 <rss version="2.0" xmlns:media="http://search.yahoo.com/mrss/"
    xmlns:atom="http://www.w3.org/2005/Atom"
    xmlns:content="http://purl.org/rss/1.0/modules/content/"
diff --git a/modules/user/controllers/admin_users.php b/modules/user/controllers/admin_users.php
index 03d9858b..48847433 100644
--- a/modules/user/controllers/admin_users.php
+++ b/modules/user/controllers/admin_users.php
@@ -287,16 +287,22 @@ class Admin_Users_Controller extends Admin_Controller {
     $form = new Forge(
       "admin/users/edit_user/$user->id", "", "post", array("id" => "g-edit-user-form"));
     $group = $form->group("edit_user")->label(t("Edit user"));
-    $group->input("name")->label(t("Username"))->id("g-username")->value($user->name);
-    $group->inputs["name"]->error_messages(
-      "conflict", t("There is already a user with that username"));
-    $group->input("full_name")->label(t("Full name"))->id("g-fullname")->value($user->full_name);
-    self::_add_locale_dropdown($group, $user);
-    $group->password("password")->label(t("Password"))->id("g-password");
+    $group->input("name")->label(t("Username"))->id("g-username")->value($user->name)
+      ->error_messages("conflict", t("There is already a user with that username"));
+    $group->input("full_name")->label(t("Full name"))->id("g-fullname")->value($user->full_name)
+      ->error_messages("length", t("This name is too long"));
+    $group->password("password")->label(t("Password"))->id("g-password")
+      ->error_messages("min_length", t("This password is too short"));
     $group->password("password2")->label(t("Confirm password"))->id("g-password2")
+      ->error_messages("matches", t("The passwords you entered do not match"))
       ->matches($group->password);
-    $group->input("email")->label(t("Email"))->id("g-email")->value($user->email);
-    $group->input("url")->label(t("URL"))->id("g-url")->value($user->url);
+    $group->input("email")->label(t("Email"))->id("g-email")->value($user->email)
+      ->error_messages("required", t("You must enter a valid email address"))
+      ->error_messages("length", t("This email address is too long"))
+      ->error_messages("email", t("You must enter a valid email address"));
+    $group->input("url")->label(t("URL"))->id("g-url")->value($user->url)
+      ->error_messages("url", t("You must enter a valid URL"));
+    self::_add_locale_dropdown($group, $user);
     $group->checkbox("admin")->label(t("Admin"))->id("g-admin")->checked($user->admin);
 
     module::event("user_edit_form_admin", $user, $form);
@@ -308,13 +314,22 @@ class Admin_Users_Controller extends Admin_Controller {
     $form = new Forge("admin/users/add_user", "", "post", array("id" => "g-add-user-form"));
     $group = $form->group("add_user")->label(t("Add user"));
     $group->input("name")->label(t("Username"))->id("g-username")
+      ->error_messages("required", t("A name is required"))
+      ->error_messages("length", t("This name is too long"))
       ->error_messages("conflict", t("There is already a user with that username"));
-    $group->input("full_name")->label(t("Full name"))->id("g-fullname");
-    $group->password("password")->label(t("Password"))->id("g-password");
+    $group->input("full_name")->label(t("Full name"))->id("g-fullname")
+      ->error_messages("length", t("This name is too long"));
+    $group->password("password")->label(t("Password"))->id("g-password")
+      ->error_messages("min_length", t("This password is too short"));
     $group->password("password2")->label(t("Confirm password"))->id("g-password2")
+      ->error_messages("matches", t("The passwords you entered do not match"))
       ->matches($group->password);
-    $group->input("email")->label(t("Email"))->id("g-email");
-    $group->input("url")->label(t("URL"))->id("g-url");
+    $group->input("email")->label(t("Email"))->id("g-email")
+      ->error_messages("required", t("You must enter a valid email address"))
+      ->error_messages("length", t("This email address is too long"))
+      ->error_messages("email", t("You must enter a valid email address"));
+    $group->input("url")->label(t("URL"))->id("g-url")
+      ->error_messages("url", t("You must enter a valid URL"));
     self::_add_locale_dropdown($group);
     $group->checkbox("admin")->label(t("Admin"))->id("g-admin");
 
diff --git a/modules/user/controllers/users.php b/modules/user/controllers/users.php
index d0c67dd1..166ff8b2 100644
--- a/modules/user/controllers/users.php
+++ b/modules/user/controllers/users.php
@@ -20,7 +20,6 @@
 class Users_Controller extends Controller {
   public function update($id) {
     $user = user::lookup($id);
-
     if ($user->guest || $user->id != identity::active_user()->id) {
       access::forbidden();
     }
@@ -29,9 +28,6 @@ class Users_Controller extends Controller {
     try {
       $valid = $form->validate();
       $user->full_name = $form->edit_user->full_name->value;
-      if ($form->edit_user->password->value) {
-        $user->password = $form->edit_user->password->value;
-      }
       $user->email = $form->edit_user->email->value;
       $user->url = $form->edit_user->url->value;
 
@@ -57,7 +53,7 @@ class Users_Controller extends Controller {
 
       $user->save();
       module::event("user_edit_form_completed", $user, $form);
-      message::success(t("User information updated."));
+      message::success(t("User information updated"));
       print json_encode(
         array("result" => "success",
               "resource" => url::site("users/{$user->id}")));
@@ -66,30 +62,93 @@ class Users_Controller extends Controller {
     }
   }
 
+  public function change_password($id) {
+    $user = user::lookup($id);
+    if ($user->guest || $user->id != identity::active_user()->id) {
+      access::forbidden();
+    }
+
+    $form = $this->_get_change_password_form($user);
+    try {
+      $valid = $form->validate();
+      $user->password = $form->change_password->password->value;
+      $user->validate();
+    } catch (ORM_Validation_Exception $e) {
+      // Translate ORM validation errors into form error messages
+      foreach ($e->validation->errors() as $key => $error) {
+        $form->change_password->inputs[$key]->add_error($error, 1);
+      }
+      $valid = false;
+    }
+
+    if ($valid) {
+      $user->save();
+      module::event("user_change_password_form_completed", $user, $form);
+      message::success(t("Password changed"));
+      module::event("user_password_change", $user);
+      print json_encode(
+        array("result" => "success",
+              "resource" => url::site("users/{$user->id}")));
+    } else {
+      log::warning("user", t("Failed password change for %name", array("name" => $user->name)));
+      $name = $user->name;
+      module::event("user_password_change_failed", $name);
+      print json_encode(array("result" => "error", "form" => (string) $form));
+    }
+  }
+
   public function form_edit($id) {
     $user = user::lookup($id);
     if ($user->guest || $user->id != identity::active_user()->id) {
       access::forbidden();
     }
 
-    $v = new View("user_form.html");
-    $v->form = $this->_get_edit_form($user);
-    print $v;
+    print $this->_get_edit_form($user);
+  }
+
+  public function form_change_password($id) {
+    $user = user::lookup($id);
+    if ($user->guest || $user->id != identity::active_user()->id) {
+      access::forbidden();
+    }
+
+    print $this->_get_change_password_form($user);
+  }
+
+  private function _get_change_password_form($user) {
+    $form = new Forge(
+      "users/change_password/$user->id", "", "post", array("id" => "g-change-password-user-form"));
+    $group = $form->group("change_password")->label(t("Change your password"));
+    $group->password("old_password")->label(t("Old password"))->id("g-password")
+      ->callback("auth::validate_too_many_failed_password_changes")
+      ->callback("user::valid_password")
+      ->error_messages("invalid", t("Incorrect password"))
+      ->error_messages(
+        "too_many_failed_password_changes",
+        t("Too many incorrect passwords.  Try again later"));
+    $group->password("password")->label(t("New password"))->id("g-password")
+      ->error_messages("min_length", t("Your new password is too short"));
+    $group->script("")
+      ->text(
+        '$("form").ready(function(){$(\'input[name="password"]\').user_password_strength();});');
+    $group->password("password2")->label(t("Confirm new password"))->id("g-password2")
+      ->matches($group->password)
+      ->error_messages("matches", t("The passwords you entered do not match"));
+
+    module::event("user_change_password_form", $user, $form);
+    $group->submit("")->value(t("Save"));
+    return $form;
   }
 
   private function _get_edit_form($user) {
     $form = new Forge("users/update/$user->id", "", "post", array("id" => "g-edit-user-form"));
-    $group = $form->group("edit_user")->label(t("Edit User: %name", array("name" => $user->name)));
+    $group = $form->group("edit_user")->label(t("Edit your profile"));
     $group->input("full_name")->label(t("Full Name"))->id("g-fullname")->value($user->full_name)
       ->error_messages("length", t("Your name is too long"));
     self::_add_locale_dropdown($group, $user);
-    $group->password("password")->label(t("Password"))->id("g-password")
-      ->error_messages("min_length", t("Your password is too short"));
-    $group->password("password2")->label(t("Confirm Password"))->id("g-password2")
-      ->matches($group->password)
-      ->error_messages("matches", t("The passwords you entered do not match"));
     $group->input("email")->label(t("Email"))->id("g-email")->value($user->email)
       ->error_messages("email", t("You must enter a valid email address"))
+      ->error_messages("length", t("Your email address is too long"))
       ->error_messages("required", t("You must enter a valid email address"));
     $group->input("url")->label(t("URL"))->id("g-url")->value($user->url);
 
diff --git a/modules/user/helpers/user.php b/modules/user/helpers/user.php
index 3561021f..7ceca6a5 100644
--- a/modules/user/helpers/user.php
+++ b/modules/user/helpers/user.php
@@ -70,6 +70,12 @@ class user_Core {
     return false;
   }
 
+  static function valid_password($password_input) {
+    if (!user::is_correct_password(identity::active_user(), $password_input->value)) {
+      $password_input->add_error("invalid", 1);
+    }
+  }
+
   /**
    * Create the hashed passwords.
    * @param string $password a plaintext password
diff --git a/modules/user/models/user.php b/modules/user/models/user.php
index baac9315..4404ee63 100644
--- a/modules/user/models/user.php
+++ b/modules/user/models/user.php
@@ -122,7 +122,7 @@ class User_Model extends ORM implements User_Definition {
   public function valid_name(Validation $v, $field) {
     if (db::build()->from("users")
         ->where("name", "=", $this->name)
-        ->where("id", "<>", $this->id)
+        ->merge_where($this->id ? array(array("id", "<>", $this->id)) : null)
         ->count_records() == 1) {
       $v->add_error("name", "conflict");
     }
@@ -136,7 +136,7 @@ class User_Model extends ORM implements User_Definition {
       return;
     }
 
-    if (!$this->loaded() || $this->password_length) {
+    if (!$this->loaded() || isset($this->password_length)) {
       $minimum_length = module::get_var("user", "mininum_password_length", 5);
       if ($this->password_length < $minimum_length) {
         $v->add_error("password", "min_length");
diff --git a/modules/user/views/user_form.html.php b/modules/user/views/user_form.html.php
deleted file mode 100644
index 4ce2b532..00000000
--- a/modules/user/views/user_form.html.php
+++ /dev/null
@@ -1,7 +0,0 @@
-<?php defined("SYSPATH") or die("No direct script access.") ?>
-<script type="text/javascript">
-  $("form").ready(function(){
-    $('input[name="password"]').user_password_strength();
-  });
-</script>
-<?= $form ?>