|
| 1 | +<?php |
| 2 | + |
| 3 | +/* |
| 4 | + * Copyright 2011 Facebook, Inc. |
| 5 | + * |
| 6 | + * Licensed under the Apache License, Version 2.0 (the "License"); |
| 7 | + * you may not use this file except in compliance with the License. |
| 8 | + * You may obtain a copy of the License at |
| 9 | + * |
| 10 | + * http://www.apache.org/licenses/LICENSE-2.0 |
| 11 | + * |
| 12 | + * Unless required by applicable law or agreed to in writing, software |
| 13 | + * distributed under the License is distributed on an "AS IS" BASIS, |
| 14 | + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 15 | + * See the License for the specific language governing permissions and |
| 16 | + * limitations under the License. |
| 17 | + */ |
| 18 | + |
| 19 | +class PhabricatorUserPasswordSettingsPanelController |
| 20 | + extends PhabricatorUserSettingsPanelController { |
| 21 | + |
| 22 | + public function processRequest() { |
| 23 | + |
| 24 | + $request = $this->getRequest(); |
| 25 | + $user = $request->getUser(); |
| 26 | + $editable = $this->getAccountEditable(); |
| 27 | + |
| 28 | + // There's no sense in showing a change password panel if the user |
| 29 | + // can't change their password |
| 30 | + if (!$editable || |
| 31 | + !PhabricatorEnv::getEnvConfig('auth.password-auth-enabled')) { |
| 32 | + return new Aphront400Response(); |
| 33 | + } |
| 34 | + |
| 35 | + $errors = array(); |
| 36 | + if ($request->isFormPost()) { |
| 37 | + if ($user->comparePassword($request->getStr('old_pw'))) { |
| 38 | + $pass = $request->getStr('new_pw'); |
| 39 | + $conf = $request->getStr('conf_pw'); |
| 40 | + if ($pass === $conf) { |
| 41 | + if (strlen($pass)) { |
| 42 | + $user->setPassword($pass); |
| 43 | + // This write is unguarded because the CSRF token has already |
| 44 | + // been checked in the call to $request->isFormPost() and |
| 45 | + // the CSRF token depends on the password hash, so when it |
| 46 | + // is changed here the CSRF token check will fail. |
| 47 | + $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites(); |
| 48 | + $user->save(); |
| 49 | + unset($unguarded); |
| 50 | + return id(new AphrontRedirectResponse()) |
| 51 | + ->setURI('/settings/page/password/?saved=true'); |
| 52 | + } else { |
| 53 | + $errors[] = 'Your new password is too short.'; |
| 54 | + } |
| 55 | + } else { |
| 56 | + $errors[] = 'New password and confirmation do not match.'; |
| 57 | + } |
| 58 | + } else { |
| 59 | + $errors[] = 'The old password you entered is incorrect.'; |
| 60 | + } |
| 61 | + } |
| 62 | + |
| 63 | + $notice = null; |
| 64 | + if (!$errors) { |
| 65 | + if ($request->getStr('saved')) { |
| 66 | + $notice = new AphrontErrorView(); |
| 67 | + $notice->setSeverity(AphrontErrorView::SEVERITY_NOTICE); |
| 68 | + $notice->setTitle('Changes Saved'); |
| 69 | + $notice->appendChild('<p>Your password has been updated.</p>'); |
| 70 | + } |
| 71 | + } else { |
| 72 | + $notice = new AphrontErrorView(); |
| 73 | + $notice->setTitle('Error Changing Password'); |
| 74 | + $notice->setErrors($errors); |
| 75 | + } |
| 76 | + |
| 77 | + $form = new AphrontFormView(); |
| 78 | + $form |
| 79 | + ->setUser($user) |
| 80 | + ->appendChild( |
| 81 | + id(new AphrontFormPasswordControl()) |
| 82 | + ->setLabel('Old Password') |
| 83 | + ->setName('old_pw')); |
| 84 | + $form |
| 85 | + ->appendChild( |
| 86 | + id(new AphrontFormPasswordControl()) |
| 87 | + ->setLabel('New Password') |
| 88 | + ->setName('new_pw')); |
| 89 | + $form |
| 90 | + ->appendChild( |
| 91 | + id(new AphrontFormPasswordControl()) |
| 92 | + ->setLabel('Confirm Password') |
| 93 | + ->setName('conf_pw')); |
| 94 | + $form |
| 95 | + ->appendChild( |
| 96 | + id(new AphrontFormSubmitControl()) |
| 97 | + ->setValue('Save')); |
| 98 | + |
| 99 | + $panel = new AphrontPanelView(); |
| 100 | + $panel->setHeader('Change Password'); |
| 101 | + $panel->setWidth(AphrontPanelView::WIDTH_FORM); |
| 102 | + $panel->appendChild($form); |
| 103 | + |
| 104 | + return id(new AphrontNullView()) |
| 105 | + ->appendChild( |
| 106 | + array( |
| 107 | + $notice, |
| 108 | + $panel, |
| 109 | + )); |
| 110 | + } |
| 111 | +} |
0 commit comments