login/forgot_password.php

   1 <?php
   2
   3 // This file is part of Moodle - http://moodle.org/
   4 //
   5 // Moodle is free software: you can redistribute it and/or modify
   6 // it under the terms of the GNU General Public License as published by
   7 // the Free Software Foundation, either version 3 of the License, or
   8 // (at your option) any later version.
   9 //
  10 // Moodle is distributed in the hope that it will be useful,
  11 // but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 // GNU General Public License for more details.
  14 //
  15 // You should have received a copy of the GNU General Public License
  16 // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
  17
  18 /**
  19  * Forgot password routine.
  20  *
  21  * Finds the user and calls the appropriate routine for their authentication type.
  22  *
  23  * @package    core
  24  * @subpackage auth
  25  * @copyright  1999 onwards Martin Dougiamas  http://dougiamas.com
  26  * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  27  */
  28
  29 require('../config.php');
  30 require_once('forgot_password_form.php');
  31
  32 $p_secret   = optional_param('p', false, PARAM_RAW);
  33 $p_username = optional_param('s', false, PARAM_RAW);
  34
  35 //HTTPS is required in this page when $CFG->loginhttps enabled
  36 $PAGE->https_required();
  37
  38 $PAGE->set_url('/login/forgot_password.php');
  39 $systemcontext = get_context_instance(CONTEXT_SYSTEM);
  40 $PAGE->set_context($systemcontext);
  41
  42 // setup text strings
  43 $strforgotten = get_string('passwordforgotten');
  44 $strlogin     = get_string('login');
  45
  46 $PAGE->navbar->add($strlogin, get_login_url());
  47 $PAGE->navbar->add($strforgotten);
  48 $PAGE->set_title($strforgotten);
  49 $PAGE->set_heading($COURSE->fullname);
  50
  51 // if alternatepasswordurl is defined, then we'll just head there
  52 if (!empty($CFG->forgottenpasswordurl)) {
  53     redirect($CFG->forgottenpasswordurl);
  54 }
  55
  56 // if you are logged in then you shouldn't be here!
  57 if (isloggedin() and !isguestuser()) {
  58     redirect($CFG->wwwroot.'/index.php', get_string('loginalready'), 5);
  59 }
  60
  61 if ($p_secret !== false) {
  62 ///=====================
  63 /// user clicked on link in email message
  64 ///=====================
  65
  66     update_login_count();
  67
  68     $user = get_complete_user_data('username', $p_username);
  69     if (!empty($user) and $user->secret === '') {
  70         echo $OUTPUT->header();
  71         print_error('secretalreadyused');
  72     } else if (!empty($user) and $user->secret == $p_secret) {
  73         // make sure that url relates to a valid user
  74
  75         // check this isn't guest user
  76         if (isguestuser($user)) {
  77             print_error('cannotresetguestpwd');
  78         }
  79
  80         // make sure user is allowed to change password
  81         require_capability('moodle/user:changeownpassword', $systemcontext, $user->id);
  82
  83         if (!reset_password_and_mail($user)) {
  84             print_error('cannotresetmail');
  85         }
  86
  87         // Clear secret so that it can not be used again
  88         $user->secret = '';
  89         $DB->set_field('user', 'secret', $user->secret, array('id'=>$user->id));
  90
  91         reset_login_count();
  92
  93         $changepasswordurl = "{$CFG->httpswwwroot}/login/change_password.php";
  94         $a = new stdClass();
  95         $a->email = $user->email;
  96         $a->link = $changepasswordurl;
  97
  98         echo $OUTPUT->header();
  99         notice(get_string('emailpasswordsent', '', $a), $changepasswordurl);
 100
 101     } else {
 102         if (!empty($user) and strlen($p_secret) === 15) {
 103             // somebody probably tries to hack in by guessing secret - stop them!
 104             $DB->set_field('user', 'secret', '', array('id'=>$user->id));
 105         }
 106         echo $OUTPUT->header();
 107         print_error('forgotteninvalidurl');
 108     }
 109
 110     die; //never reached
 111 }
 112
 113 $mform = new login_forgot_password_form();
 114
 115 if ($mform->is_cancelled()) {
 116     redirect(get_login_url());
 117
 118 } else if ($data = $mform->get_data()) {
 119 /// find the user in the database and mail info
 120
 121     // first try the username
 122     if (!empty($data->username)) {
 123         $user = get_complete_user_data('username', $data->username);
 124     } else {
 125
 126         $user = get_complete_user_data('email', $data->email);
 127     }
 128
 129     if ($user and !empty($user->confirmed)) {
 130
 131         $userauth = get_auth_plugin($user->auth);
 132         if (has_capability('moodle/user:changeownpassword', $systemcontext, $user->id)) {
 133             // send email
 134         }
 135
 136         if ($userauth->can_reset_password() and is_enabled_auth($user->auth)
 137           and has_capability('moodle/user:changeownpassword', $systemcontext, $user->id)) {
 138             // send reset password confirmation
 139
 140             // set 'secret' string
 141             $user->secret = random_string(15);
 142             $DB->set_field('user', 'secret', $user->secret, array('id'=>$user->id));
 143
 144             if (!send_password_change_confirmation_email($user)) {
 145                 print_error('cannotmailconfirm');
 146             }
 147
 148         } else {
 149             if (!send_password_change_info($user)) {
 150                 print_error('cannotmailconfirm');
 151             }
 152         }
 153     }
 154
 155     echo $OUTPUT->header();
 156
 157     if (empty($user->email) or !empty($CFG->protectusernames)) {
 158         // Print general confirmation message
 159         notice(get_string('emailpasswordconfirmmaybesent'), $CFG->wwwroot.'/index.php');
 160
 161     } else {
 162         // Confirm email sent
 163         $protectedemail = preg_replace('/([^@]*)@(.*)/', '******@$2', $user->email); // obfuscate the email address to protect privacy
 164         $stremailpasswordconfirmsent = get_string('emailpasswordconfirmsent', '', $protectedemail);
 165         notice($stremailpasswordconfirmsent, $CFG->wwwroot.'/index.php');
 166     }
 167
 168     die; // never reached
 169 }
 170
 171 // make sure we really are on the https page when https login required
 172 $PAGE->verify_https_required();
 173
 174
 175 /// DISPLAY FORM
 176
 177 echo $OUTPUT->header();
 178 echo $OUTPUT->box(get_string('passwordforgotteninstructions2'), 'generalbox boxwidthnormal boxaligncenter');
 179 $mform->display();
 180
 181 echo $OUTPUT->footer();