summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--lib/gallery.in_place_edit.js44
-rw-r--r--modules/gallery/controllers/admin_maintenance.php14
-rw-r--r--modules/gallery/css/l10n_client.css3
-rw-r--r--modules/gallery/helpers/album.php9
-rw-r--r--modules/gallery/helpers/auth.php10
-rw-r--r--modules/gallery/helpers/gallery_event.php12
-rw-r--r--modules/gallery/helpers/gallery_installer.php14
-rw-r--r--modules/gallery/helpers/task.php9
-rw-r--r--modules/gallery/module.info2
-rw-r--r--modules/gallery/tests/xss_data.txt25
-rw-r--r--modules/gallery/views/admin_advanced_settings.html.php6
-rw-r--r--modules/gallery/views/admin_maintenance.html.php10
-rw-r--r--modules/gallery/views/in_place_edit.html.php6
-rw-r--r--modules/gallery/views/user_profile.html.php7
-rw-r--r--modules/rss/views/feed.mrss.php2
-rw-r--r--modules/user/controllers/admin_users.php39
-rw-r--r--modules/user/controllers/users.php87
-rw-r--r--modules/user/helpers/user.php6
-rw-r--r--modules/user/models/user.php4
-rw-r--r--modules/user/views/user_form.html.php7
20 files changed, 219 insertions, 97 deletions
diff --git a/lib/gallery.in_place_edit.js b/lib/gallery.in_place_edit.js
index c10400e3..5a815dac 100644
--- a/lib/gallery.in_place_edit.js
+++ b/lib/gallery.in_place_edit.js
@@ -10,10 +10,10 @@
},
_show: function(target) {
- if ($(this).data("gallery_in_place_edit") == true) {
+ if ($(target).data("gallery_in_place_edit") == true) {
return;
}
- $(this).data("gallery_in_place_edit", true);
+ $(target).data("gallery_in_place_edit", true);
var self = this;
var tag_width = $(target).width();
$(self).data("tag_width", tag_width);
@@ -27,26 +27,28 @@
var parent = $(target).parent();
parent.children().hide();
parent.append(data);
- parent.find("form :text")
- .width(tag_width)
- .focus();
- $(".g-short-form").gallery_short_form();
- parent.find("form .g-cancel").click(function(event) {
- self._cancel();
- event.preventDefault();
- return false;
- });
- self._ajaxify_edit();
+ self._setup_form(parent.find("form"));
});
+ },
+ _setup_form: function(form) {
+ var self = this;
+ var width = $(self).data("tag_width");
+ form.find(":text").width(width).focus();
+ form.find(".g-cancel").click(function(event) {
+ self._cancel();
+ event.preventDefault();
+ return false;
+ });
+ $(".g-short-form").gallery_short_form();
+ this._ajaxify_edit();
},
_cancel: function() {
var parent = $("#g-in-place-edit-form").parent();
- $(parent).find("form").remove();
+ $("#g-in-place-edit-form").remove();
$(parent).children().show();
- $("#g-in-place-edit-message").remove();
- $(this).data("gallery_in_place_edit", false);
+ $(parent).find(".g-editable").data("gallery_in_place_edit", false);
},
_ajaxify_edit: function() {
@@ -60,17 +62,7 @@
} else {
var parent = $(form).parent();
$(form).replaceWith(data.form);
- var width = $(self).data("tag_width");
- $(parent).find("form :text")
- .width(width)
- .focus();
- $(".g-short-form").gallery_short_form();
- $(parent).find("form .g-cancel").click(function(event) {
- self._cancel();
- event.preventDefault();
- return false;
- });
- self._ajaxify_edit();
+ self._setup_form(parent.find("form"));
}
}
});
diff --git a/modules/gallery/controllers/admin_maintenance.php b/modules/gallery/controllers/admin_maintenance.php
index 3062ea09..8e4845a9 100644
--- a/modules/gallery/controllers/admin_maintenance.php
+++ b/modules/gallery/controllers/admin_maintenance.php
@@ -46,6 +46,15 @@ class Admin_Maintenance_Controller extends Admin_Controller {
->where("done", "=", 0)->order_by("updated", "DESC")->find_all();
$view->content->finished_tasks = ORM::factory("task")
->where("done", "=", 1)->order_by("updated", "DESC")->find_all();
+ $task_buttons =
+ new ArrayObject(array((object)array("text" => t("run"),
+ "url" =>url::site("admin/maintenance/start"))));
+ module::event("admin_maintenance_task_buttons", $task_buttons);
+ $view->content->task_buttons = $task_buttons;
+
+ $maintenance_content = new ArrayObject();
+ module::event("admin_maintenance_content", $maintenance_content);
+ $view->content->task_maintenance_content = $maintenance_content;
print $view;
}
@@ -56,13 +65,10 @@ class Admin_Maintenance_Controller extends Admin_Controller {
public function start($task_callback) {
access::verify_csrf();
- $tasks = task::get_definitions();
- $task = task::create($tasks[$task_callback], array());
+ $task = task::start($task_callback);
$view = new View("admin_maintenance_task.html");
$view->task = $task;
- $task->log(t("Task %task_name started (task id %task_id)",
- array("task_name" => $task->name, "task_id" => $task->id)));
log::info("tasks", t("Task %task_name started (task id %task_id)",
array("task_name" => $task->name, "task_id" => $task->id)),
html::anchor("admin/maintenance", t("maintenance")));
diff --git a/modules/gallery/css/l10n_client.css b/modules/gallery/css/l10n_client.css
index 053b4432..90034d0c 100644
--- a/modules/gallery/css/l10n_client.css
+++ b/modules/gallery/css/l10n_client.css
@@ -45,7 +45,6 @@
display:block;
position:absolute; right:0em;
height:2em; line-height:2em;
- text-transform:uppercase;
text-align:center; background:#000;
}
#l10n-client-toggler a {
@@ -62,7 +61,7 @@
height:1em; line-height:1em;
padding: .5em; margin:0px;
font-size:1em;
- text-transform:uppercase;}
+}
#l10n-client .strings h2 {
border:0px;}
diff --git a/modules/gallery/helpers/album.php b/modules/gallery/helpers/album.php
index 389f6e48..15e0c3ca 100644
--- a/modules/gallery/helpers/album.php
+++ b/modules/gallery/helpers/album.php
@@ -36,7 +36,8 @@ class album_Core {
$group->input("name")->label(t("Directory name"))
->error_messages("no_slashes", t("The directory name can't contain the \"/\" character"))
->error_messages("required", t("You must provide a directory name"))
- ->error_messages("length", t("Your directory name is too long"));
+ ->error_messages("length", t("Your directory name is too long"))
+ ->error_messages("conflict", t("There is already a movie, photo or album with this name"));
$group->input("slug")->label(t("Internet Address"))
->error_messages(
"not_url_safe",
@@ -51,7 +52,8 @@ class album_Core {
}
static function get_edit_form($parent) {
- $form = new Forge("albums/update/{$parent->id}", "", "post", array("id" => "g-edit-album-form"));
+ $form = new Forge(
+ "albums/update/{$parent->id}", "", "post", array("id" => "g-edit-album-form"));
$form->hidden("from_id");
$group = $form->group("edit_item")->label(t("Edit Album"));
@@ -61,8 +63,7 @@ class album_Core {
$group->textarea("description")->label(t("Description"))->value($parent->description);
if ($parent->id != 1) {
$group->input("name")->label(t("Directory Name"))->value($parent->name)
- ->error_messages(
- "conflict", t("There is already a movie, photo or album with this name"))
+ ->error_messages("conflict", t("There is already a movie, photo or album with this name"))
->error_messages("no_slashes", t("The directory name can't contain a \"/\""))
->error_messages("no_trailing_period", t("The directory name can't end in \".\""))
->error_messages("required", t("You must provide a directory name"))
diff --git a/modules/gallery/helpers/auth.php b/modules/gallery/helpers/auth.php
index 16f8915a..717cf40a 100644
--- a/modules/gallery/helpers/auth.php
+++ b/modules/gallery/helpers/auth.php
@@ -78,10 +78,16 @@ class auth_Core {
}
}
+ static function validate_too_many_failed_password_changes($password_input) {
+ if (self::too_many_failed_logins(identity::active_user()->name)) {
+ $password_input->add_error("too_many_failed_password_changes", 1);
+ }
+ }
+
/**
* Record a failed login for this user
*/
- static function record_failed_login($name) {
+ static function record_failed_auth_attempts($name) {
$failed_login = ORM::factory("failed_login")
->where("name", "=", $name)
->find();
@@ -96,7 +102,7 @@ class auth_Core {
/**
* Clear any failed logins for this user
*/
- static function record_successful_login($user) {
+ static function clear_failed_logins($user) {
db::build()
->delete("failed_logins")
->where("name", "=", $user->name)
diff --git a/modules/gallery/helpers/gallery_event.php b/modules/gallery/helpers/gallery_event.php
index 6479e2c3..7b538c49 100644
--- a/modules/gallery/helpers/gallery_event.php
+++ b/modules/gallery/helpers/gallery_event.php
@@ -110,11 +110,19 @@ class gallery_event_Core {
graphics::choose_default_toolkit();
module::clear_var("gallery", "choose_default_tookit");
}
- auth::record_successful_login($user);
+ auth::clear_failed_auth_attempts($user);
}
static function user_login_failed($name) {
- auth::record_failed_login($name);
+ auth::record_failed_auth_attempts($name);
+ }
+
+ static function user_password_changed($user) {
+ auth::clear_failed_auth_attempts($user);
+ }
+
+ static function user_password_change_failed($name) {
+ auth::record_failed_auth_attempts($name);
}
static function item_index_data($item, $data) {
diff --git a/modules/gallery/helpers/gallery_installer.php b/modules/gallery/helpers/gallery_installer.php
index bffef8e6..761843b0 100644
--- a/modules/gallery/helpers/gallery_installer.php
+++ b/modules/gallery/helpers/gallery_installer.php
@@ -287,7 +287,7 @@ class gallery_installer {
// @todo this string needs to be picked up by l10n_scanner
module::set_var("gallery", "credits", "Powered by <a href=\"%url\">Gallery %version</a>");
module::set_var("gallery", "simultaneous_upload_limit", 5);
- module::set_version("gallery", 25);
+ module::set_version("gallery", 26);
}
static function upgrade($version) {
@@ -514,6 +514,18 @@ class gallery_installer {
}
module::set_version("gallery", $version = 25);
}
+
+ if ($version == 25) {
+ db::build()
+ ->update("items")
+ ->set("title", new Database_Expression("`name`"))
+ ->and_open()
+ ->where("title", "IS", null)
+ ->or_where("title", "=", "")
+ ->close()
+ ->execute();
+ module::set_version("gallery", $version = 26);
+ }
}
static function uninstall() {
diff --git a/modules/gallery/helpers/task.php b/modules/gallery/helpers/task.php
index 645850d1..aa0eb94d 100644
--- a/modules/gallery/helpers/task.php
+++ b/modules/gallery/helpers/task.php
@@ -35,6 +35,15 @@ class task_Core {
return $tasks;
}
+ static function start($task_callback, $context=array()) {
+ $tasks = task::get_definitions();
+ $task = task::create($tasks[$task_callback], array());
+
+ $task->log(t("Task %task_name started (task id %task_id)",
+ array("task_name" => $task->name, "task_id" => $task->id)));
+ return $task;
+ }
+
static function create($task_def, $context) {
$task = ORM::factory("task");
$task->callback = $task_def->callback;
diff --git a/modules/gallery/module.info b/modules/gallery/module.info
index 50a1505f..fd241066 100644
--- a/modules/gallery/module.info
+++ b/modules/gallery/module.info
@@ -1,3 +1,3 @@
name = "Gallery 3"
description = "Gallery core application"
-version = 25
+version = 26
diff --git a/modules/gallery/tests/xss_data.txt b/modules/gallery/tests/xss_data.txt
index 65b45a08..e53502ee 100644
--- a/modules/gallery/tests/xss_data.txt
+++ b/modules/gallery/tests/xss_data.txt
@@ -81,18 +81,19 @@ modules/gallery/views/admin_maintenance.html.php 24 DIRTY_ATTR log:
modules/gallery/views/admin_maintenance.html.php 25 DIRTY_ATTR log::severity_class($task->severity)
modules/gallery/views/admin_maintenance.html.php 26 DIRTY $task->name
modules/gallery/views/admin_maintenance.html.php 29 DIRTY $task->description
-modules/gallery/views/admin_maintenance.html.php 70 DIRTY_ATTR text::alternate("g-odd","g-even")
-modules/gallery/views/admin_maintenance.html.php 70 DIRTY_ATTR $task->state=="stalled"?"g-warning":""
-modules/gallery/views/admin_maintenance.html.php 71 DIRTY_ATTR $task->state=="stalled"?"g-warning":""
-modules/gallery/views/admin_maintenance.html.php 72 DIRTY gallery::date_time($task->updated)
-modules/gallery/views/admin_maintenance.html.php 75 DIRTY $task->name
-modules/gallery/views/admin_maintenance.html.php 90 DIRTY $task->status
-modules/gallery/views/admin_maintenance.html.php 141 DIRTY_ATTR text::alternate("g-odd","g-even")
-modules/gallery/views/admin_maintenance.html.php 141 DIRTY_ATTR $task->state=="success"?"g-success":"g-error"
-modules/gallery/views/admin_maintenance.html.php 142 DIRTY_ATTR $task->state=="success"?"g-success":"g-error"
-modules/gallery/views/admin_maintenance.html.php 143 DIRTY gallery::date_time($task->updated)
-modules/gallery/views/admin_maintenance.html.php 146 DIRTY $task->name
-modules/gallery/views/admin_maintenance.html.php 158 DIRTY $task->status
+modules/gallery/views/admin_maintenance.html.php 33 DIRTY_JS "{$button->url}/$task->callback?csrf=$csrf"
+modules/gallery/views/admin_maintenance.html.php 76 DIRTY_ATTR text::alternate("g-odd","g-even")
+modules/gallery/views/admin_maintenance.html.php 76 DIRTY_ATTR $task->state=="stalled"?"g-warning":""
+modules/gallery/views/admin_maintenance.html.php 77 DIRTY_ATTR $task->state=="stalled"?"g-warning":""
+modules/gallery/views/admin_maintenance.html.php 78 DIRTY gallery::date_time($task->updated)
+modules/gallery/views/admin_maintenance.html.php 81 DIRTY $task->name
+modules/gallery/views/admin_maintenance.html.php 96 DIRTY $task->status
+modules/gallery/views/admin_maintenance.html.php 147 DIRTY_ATTR text::alternate("g-odd","g-even")
+modules/gallery/views/admin_maintenance.html.php 147 DIRTY_ATTR $task->state=="success"?"g-success":"g-error"
+modules/gallery/views/admin_maintenance.html.php 148 DIRTY_ATTR $task->state=="success"?"g-success":"g-error"
+modules/gallery/views/admin_maintenance.html.php 149 DIRTY gallery::date_time($task->updated)
+modules/gallery/views/admin_maintenance.html.php 152 DIRTY $task->name
+modules/gallery/views/admin_maintenance.html.php 164 DIRTY $task->status
modules/gallery/views/admin_maintenance_show_log.html.php 8 DIRTY_JS url::site("admin/maintenance/save_log/$task->id?csrf=$csrf")
modules/gallery/views/admin_maintenance_show_log.html.php 13 DIRTY $task->name
modules/gallery/views/admin_maintenance_task.html.php 55 DIRTY $task->name
diff --git a/modules/gallery/views/admin_advanced_settings.html.php b/modules/gallery/views/admin_advanced_settings.html.php
index 2d4b11a1..1f7d2f64 100644
--- a/modules/gallery/views/admin_advanced_settings.html.php
+++ b/modules/gallery/views/admin_advanced_settings.html.php
@@ -25,10 +25,10 @@
<a href="<?= url::site("admin/advanced_settings/edit/$var->module_name/" . html::clean($var->name)) ?>"
class="g-dialog-link"
title="<?= t("Edit %var (%module_name)", array("var" => $var->name, "module_name" => $var->module_name))->for_html_attr() ?>">
- <? if (isset($var->value)): ?>
- <?= html::clean($var->value) ?>
- <? else: ?>
+ <? if (!isset($var->value) || $var->value === ""): ?>
<i> <?= t("empty") ?> </i>
+ <? else: ?>
+ <?= html::clean($var->value) ?>
<? endif ?>
</a>
</td>
diff --git a/modules/gallery/views/admin_maintenance.html.php b/modules/gallery/views/admin_maintenance.html.php
index ac597715..19375670 100644
--- a/modules/gallery/views/admin_maintenance.html.php
+++ b/modules/gallery/views/admin_maintenance.html.php
@@ -29,16 +29,22 @@
<?= $task->description ?>
</td>
<td>
- <a href="<?= url::site("admin/maintenance/start/$task->callback?csrf=$csrf") ?>"
+ <? foreach ($task_buttons as $button): ?>
+ <a href="<?= "{$button->url}/$task->callback?csrf=$csrf" ?>"
class="g-dialog-link g-button ui-icon-left ui-state-default ui-corner-all">
- <?= t("run") ?>
+ <?= html::clean($button->text) ?>
</a>
+ <? endforeach ?>
</td>
</tr>
<? endforeach ?>
</table>
</div>
+ <? foreach ($task_maintenance_content as $content): ?>
+ <?= html::purify($content) ?>
+ <? endforeach ?>
+
<? if ($running_tasks->count()): ?>
<div id="g-running-tasks">
<h2> <?= t("Running tasks") ?> </h2>
diff --git a/modules/gallery/views/in_place_edit.html.php b/modules/gallery/views/in_place_edit.html.php
index 05a16ad4..2d6cbe90 100644
--- a/modules/gallery/views/in_place_edit.html.php
+++ b/modules/gallery/views/in_place_edit.html.php
@@ -9,7 +9,13 @@
<?= form::submit(array("class" => "submit ui-state-default"), t("Save")) ?>
</li>
<li><a href="#" class="g-cancel"><?= t("Cancel") ?></a></li>
+ <? if (!empty($errors["input"])): ?>
+ <li>
+ <p id="g-in-place-edit-message" class="g-error"><?= $errors["input"] ?></p>
+ </li>
+ <? endif ?>
</ul>
</form>
+
diff --git a/modules/gallery/views/user_profile.html.php b/modules/gallery/views/user_profile.html.php
index f35f8c3f..78e1c579 100644
--- a/modules/gallery/views/user_profile.html.php
+++ b/modules/gallery/views/user_profile.html.php
@@ -57,13 +57,16 @@
</a>
<? endif ?>
<? if ($editable): ?>
- <a class="g-button ui-icon-right ui-state-default ui-corner-all g-dialog-link" href="<?= url::site("form/edit/users/{$user->id}") ?>">
+ <a class="g-button ui-icon-right ui-state-default ui-corner-all g-dialog-link" href="<?= url::site("form/edit/users/{$user->id}") ?>">
<?= t("Edit") ?>
</a>
+ <a class="g-button ui-icon-right ui-state-default ui-corner-all g-dialog-link" href="<?= url::site("users/form_change_password/{$user->id}") ?>">
+ <?= t("Change password") ?>
+ </a>
<? endif ?>
<a id="g-profile-return" class="g-button ui-icon-right ui-state-default ui-corner-all" href="#">
<?= t("Return") ?>
</a>
</div>
-</div> \ No newline at end of file
+</div>
diff --git a/modules/rss/views/feed.mrss.php b/modules/rss/views/feed.mrss.php
index a61ee96c..cdb4f0f0 100644
--- a/modules/rss/views/feed.mrss.php
+++ b/modules/rss/views/feed.mrss.php
@@ -1,5 +1,5 @@
<?php defined("SYSPATH") or die("No direct script access.") ?>
-<? echo "<?xml version=\"1.0\" ?>" ?>
+<? echo '<?xml version="1.0" ?>' ?>
<rss version="2.0" xmlns:media="http://search.yahoo.com/mrss/"
xmlns:atom="http://www.w3.org/2005/Atom"
xmlns:content="http://purl.org/rss/1.0/modules/content/"
diff --git a/modules/user/controllers/admin_users.php b/modules/user/controllers/admin_users.php
index 03d9858b..48847433 100644
--- a/modules/user/controllers/admin_users.php
+++ b/modules/user/controllers/admin_users.php
@@ -287,16 +287,22 @@ class Admin_Users_Controller extends Admin_Controller {
$form = new Forge(
"admin/users/edit_user/$user->id", "", "post", array("id" => "g-edit-user-form"));
$group = $form->group("edit_user")->label(t("Edit user"));
- $group->input("name")->label(t("Username"))->id("g-username")->value($user->name);
- $group->inputs["name"]->error_messages(
- "conflict", t("There is already a user with that username"));
- $group->input("full_name")->label(t("Full name"))->id("g-fullname")->value($user->full_name);
- self::_add_locale_dropdown($group, $user);
- $group->password("password")->label(t("Password"))->id("g-password");
+ $group->input("name")->label(t("Username"))->id("g-username")->value($user->name)
+ ->error_messages("conflict", t("There is already a user with that username"));
+ $group->input("full_name")->label(t("Full name"))->id("g-fullname")->value($user->full_name)
+ ->error_messages("length", t("This name is too long"));
+ $group->password("password")->label(t("Password"))->id("g-password")
+ ->error_messages("min_length", t("This password is too short"));
$group->password("password2")->label(t("Confirm password"))->id("g-password2")
+ ->error_messages("matches", t("The passwords you entered do not match"))
->matches($group->password);
- $group->input("email")->label(t("Email"))->id("g-email")->value($user->email);
- $group->input("url")->label(t("URL"))->id("g-url")->value($user->url);
+ $group->input("email")->label(t("Email"))->id("g-email")->value($user->email)
+ ->error_messages("required", t("You must enter a valid email address"))
+ ->error_messages("length", t("This email address is too long"))
+ ->error_messages("email", t("You must enter a valid email address"));
+ $group->input("url")->label(t("URL"))->id("g-url")->value($user->url)
+ ->error_messages("url", t("You must enter a valid URL"));
+ self::_add_locale_dropdown($group, $user);
$group->checkbox("admin")->label(t("Admin"))->id("g-admin")->checked($user->admin);
module::event("user_edit_form_admin", $user, $form);
@@ -308,13 +314,22 @@ class Admin_Users_Controller extends Admin_Controller {
$form = new Forge("admin/users/add_user", "", "post", array("id" => "g-add-user-form"));
$group = $form->group("add_user")->label(t("Add user"));
$group->input("name")->label(t("Username"))->id("g-username")
+ ->error_messages("required", t("A name is required"))
+ ->error_messages("length", t("This name is too long"))
->error_messages("conflict", t("There is already a user with that username"));
- $group->input("full_name")->label(t("Full name"))->id("g-fullname");
- $group->password("password")->label(t("Password"))->id("g-password");
+ $group->input("full_name")->label(t("Full name"))->id("g-fullname")
+ ->error_messages("length", t("This name is too long"));
+ $group->password("password")->label(t("Password"))->id("g-password")
+ ->error_messages("min_length", t("This password is too short"));
$group->password("password2")->label(t("Confirm password"))->id("g-password2")
+ ->error_messages("matches", t("The passwords you entered do not match"))
->matches($group->password);
- $group->input("email")->label(t("Email"))->id("g-email");
- $group->input("url")->label(t("URL"))->id("g-url");
+ $group->input("email")->label(t("Email"))->id("g-email")
+ ->error_messages("required", t("You must enter a valid email address"))
+ ->error_messages("length", t("This email address is too long"))
+ ->error_messages("email", t("You must enter a valid email address"));
+ $group->input("url")->label(t("URL"))->id("g-url")
+ ->error_messages("url", t("You must enter a valid URL"));
self::_add_locale_dropdown($group);
$group->checkbox("admin")->label(t("Admin"))->id("g-admin");
diff --git a/modules/user/controllers/users.php b/modules/user/controllers/users.php
index d0c67dd1..166ff8b2 100644
--- a/modules/user/controllers/users.php
+++ b/modules/user/controllers/users.php
@@ -20,7 +20,6 @@
class Users_Controller extends Controller {
public function update($id) {
$user = user::lookup($id);
-
if ($user->guest || $user->id != identity::active_user()->id) {
access::forbidden();
}
@@ -29,9 +28,6 @@ class Users_Controller extends Controller {
try {
$valid = $form->validate();
$user->full_name = $form->edit_user->full_name->value;
- if ($form->edit_user->password->value) {
- $user->password = $form->edit_user->password->value;
- }
$user->email = $form->edit_user->email->value;
$user->url = $form->edit_user->url->value;
@@ -57,7 +53,7 @@ class Users_Controller extends Controller {
$user->save();
module::event("user_edit_form_completed", $user, $form);
- message::success(t("User information updated."));
+ message::success(t("User information updated"));
print json_encode(
array("result" => "success",
"resource" => url::site("users/{$user->id}")));
@@ -66,30 +62,93 @@ class Users_Controller extends Controller {
}
}
+ public function change_password($id) {
+ $user = user::lookup($id);
+ if ($user->guest || $user->id != identity::active_user()->id) {
+ access::forbidden();
+ }
+
+ $form = $this->_get_change_password_form($user);
+ try {
+ $valid = $form->validate();
+ $user->password = $form->change_password->password->value;
+ $user->validate();
+ } catch (ORM_Validation_Exception $e) {
+ // Translate ORM validation errors into form error messages
+ foreach ($e->validation->errors() as $key => $error) {
+ $form->change_password->inputs[$key]->add_error($error, 1);
+ }
+ $valid = false;
+ }
+
+ if ($valid) {
+ $user->save();
+ module::event("user_change_password_form_completed", $user, $form);
+ message::success(t("Password changed"));
+ module::event("user_password_change", $user);
+ print json_encode(
+ array("result" => "success",
+ "resource" => url::site("users/{$user->id}")));
+ } else {
+ log::warning("user", t("Failed password change for %name", array("name" => $user->name)));
+ $name = $user->name;
+ module::event("user_password_change_failed", $name);
+ print json_encode(array("result" => "error", "form" => (string) $form));
+ }
+ }
+
public function form_edit($id) {
$user = user::lookup($id);
if ($user->guest || $user->id != identity::active_user()->id) {
access::forbidden();
}
- $v = new View("user_form.html");
- $v->form = $this->_get_edit_form($user);
- print $v;
+ print $this->_get_edit_form($user);
+ }
+
+ public function form_change_password($id) {
+ $user = user::lookup($id);
+ if ($user->guest || $user->id != identity::active_user()->id) {
+ access::forbidden();
+ }
+
+ print $this->_get_change_password_form($user);
+ }
+
+ private function _get_change_password_form($user) {
+ $form = new Forge(
+ "users/change_password/$user->id", "", "post", array("id" => "g-change-password-user-form"));
+ $group = $form->group("change_password")->label(t("Change your password"));
+ $group->password("old_password")->label(t("Old password"))->id("g-password")
+ ->callback("auth::validate_too_many_failed_password_changes")
+ ->callback("user::valid_password")
+ ->error_messages("invalid", t("Incorrect password"))
+ ->error_messages(
+ "too_many_failed_password_changes",
+ t("Too many incorrect passwords. Try again later"));
+ $group->password("password")->label(t("New password"))->id("g-password")
+ ->error_messages("min_length", t("Your new password is too short"));
+ $group->script("")
+ ->text(
+ '$("form").ready(function(){$(\'input[name="password"]\').user_password_strength();});');
+ $group->password("password2")->label(t("Confirm new password"))->id("g-password2")
+ ->matches($group->password)
+ ->error_messages("matches", t("The passwords you entered do not match"));
+
+ module::event("user_change_password_form", $user, $form);
+ $group->submit("")->value(t("Save"));
+ return $form;
}
private function _get_edit_form($user) {
$form = new Forge("users/update/$user->id", "", "post", array("id" => "g-edit-user-form"));
- $group = $form->group("edit_user")->label(t("Edit User: %name", array("name" => $user->name)));
+ $group = $form->group("edit_user")->label(t("Edit your profile"));
$group->input("full_name")->label(t("Full Name"))->id("g-fullname")->value($user->full_name)
->error_messages("length", t("Your name is too long"));
self::_add_locale_dropdown($group, $user);
- $group->password("password")->label(t("Password"))->id("g-password")
- ->error_messages("min_length", t("Your password is too short"));
- $group->password("password2")->label(t("Confirm Password"))->id("g-password2")
- ->matches($group->password)
- ->error_messages("matches", t("The passwords you entered do not match"));
$group->input("email")->label(t("Email"))->id("g-email")->value($user->email)
->error_messages("email", t("You must enter a valid email address"))
+ ->error_messages("length", t("Your email address is too long"))
->error_messages("required", t("You must enter a valid email address"));
$group->input("url")->label(t("URL"))->id("g-url")->value($user->url);
diff --git a/modules/user/helpers/user.php b/modules/user/helpers/user.php
index 3561021f..7ceca6a5 100644
--- a/modules/user/helpers/user.php
+++ b/modules/user/helpers/user.php
@@ -70,6 +70,12 @@ class user_Core {
return false;
}
+ static function valid_password($password_input) {
+ if (!user::is_correct_password(identity::active_user(), $password_input->value)) {
+ $password_input->add_error("invalid", 1);
+ }
+ }
+
/**
* Create the hashed passwords.
* @param string $password a plaintext password
diff --git a/modules/user/models/user.php b/modules/user/models/user.php
index baac9315..4404ee63 100644
--- a/modules/user/models/user.php
+++ b/modules/user/models/user.php
@@ -122,7 +122,7 @@ class User_Model extends ORM implements User_Definition {
public function valid_name(Validation $v, $field) {
if (db::build()->from("users")
->where("name", "=", $this->name)
- ->where("id", "<>", $this->id)
+ ->merge_where($this->id ? array(array("id", "<>", $this->id)) : null)
->count_records() == 1) {
$v->add_error("name", "conflict");
}
@@ -136,7 +136,7 @@ class User_Model extends ORM implements User_Definition {
return;
}
- if (!$this->loaded() || $this->password_length) {
+ if (!$this->loaded() || isset($this->password_length)) {
$minimum_length = module::get_var("user", "mininum_password_length", 5);
if ($this->password_length < $minimum_length) {
$v->add_error("password", "min_length");
diff --git a/modules/user/views/user_form.html.php b/modules/user/views/user_form.html.php
deleted file mode 100644
index 4ce2b532..00000000
--- a/modules/user/views/user_form.html.php
+++ /dev/null
@@ -1,7 +0,0 @@
-<?php defined("SYSPATH") or die("No direct script access.") ?>
-<script type="text/javascript">
- $("form").ready(function(){
- $('input[name="password"]').user_password_strength();
- });
-</script>
-<?= $form ?>
generated by cgit v1.2.3 (git 2.46.0) at 2025-10-14 21:19:30 +0000