Skip to content
Browse files

MDL-13811 Completed the required changes. Also added a "Cancel email …

…change" link.
  • Loading branch information...
1 parent 4c3a837 commit f978083108d5e06f4c844c16eae451088b024e7c nicolasconnault committed Jul 5, 2008
Showing with 174 additions and 11 deletions.
  1. +1 −0 admin/settings/security.php
  2. +2 −0 lang/en_utf8/admin.php
  3. +21 −4 lang/en_utf8/auth.php
  4. +70 −3 user/edit.php
  5. +15 −3 user/editlib.php
  6. +64 −0 user/emailupdate.php
  7. +1 −1 version.php
View
1 admin/settings/security.php
@@ -61,6 +61,7 @@
$options2[$option->id] = $option->name;
}
$temp->add(new admin_setting_configmultiselect('defaultallowedmodules', get_string('defaultallowedmodules', 'admin'), get_string('configdefaultallowedmodules', 'admin'), array(), $options2));
+$temp->add(new admin_setting_configcheckbox('emailchangeconfirmation', get_string('emailchangeconfirmation', 'admin'), get_string('configemailchangeconfirmation', 'admin'), 0));
$ADMIN->add('security', $temp);
View
2 lang/en_utf8/admin.php
@@ -87,6 +87,7 @@
$string['configdoctonewwindow'] = 'If you enable this, then links to Moodle Docs will be showed in a new window.';
$string['configeditorfontlist'] = 'Select the fonts that should appear in the editor\'s drop-down list.';
$string['configeditordictionary'] = 'This value will be used if aspell doesn\'t have dictionary for users own language.';
+$string['configemailchangeconfirmation'] = 'Require an email confirmation step when users change their email address in their profile.';
$string['configenableajax'] = 'This setting allows you to control the use of AJAX (advanced client/server interfaces using Javascript) across the whole site. With this setting enabled users can still make a choice in their profile, otherwise AJAX is disabled for everybody.';
$string['configenablecourserequests'] = 'This will allow any user to request a course be created.';
$string['configenableglobalsearch'] = 'This setting enables global text searching in resources and activities, it is not compatible with PHP 4.';
@@ -265,6 +266,7 @@
$string['editorspellinghelp'] = 'Enable or disable spell-checking. When enabled, <strong>aspell</strong> must be installed on the server.';
$string['editorspelling'] = 'Editor spelling';
$string['editstrings'] = 'Edit words or phrases';
+$string['emailchangeconfirmation'] = 'Email change confirmation';
$string['enableajax'] = 'Enable AJAX';
$string['enablecourserequests'] = 'Enable course requests';
$string['enableglobalsearch'] = 'Enable global search';
View
25 lang/en_utf8/auth.php
@@ -1,4 +1,4 @@
-<?php // $Id$
+<?php // $Id$
// auth.php - created with Moodle 1.5 UNSTABLE DEVELOPMENT (2005010100)
$string['auth_cas_proxycas_key'] = "Proxy mode";
@@ -109,10 +109,27 @@
$string['auth_dbchangepasswordurl_key'] = 'Password-change URL';
// Email plugin
+$string['auth_emailchangecancel'] = 'Cancel email change';
+$string['auth_emailchangepending'] = 'Change pending. Open the link sent to you at $a->preference_newemail.';
$string['auth_emaildescription'] = 'Email confirmation is the default authentication method. When the user signs up, choosing their own new username and password, a confirmation email is sent to the user\'s email address. This email contains a secure link to a page where the user can confirm their account. Future logins just check the username and password against the stored values in the Moodle database.';
+$string['auth_emailnowexists'] = 'The email address you tried to assign to your profile has been assigned to someone else since your original request. Your request for change of email address is hereby cancelled, but you may try again with a different address.';
$string['auth_emailtitle'] = 'Email-based self-registration';
$string['auth_emailnoinsert'] = 'Could not add your record to the database!';
$string['auth_emailnoemail'] = 'Tried to send you an email but failed!';
+$string['auth_emailrecaptcha'] = 'Adds a visual/audio confirmation form element to the signup page for email self-registering users. This protects your site against spammers and contributes to a worthwhile cause. See http://recaptcha.net/learnmore.html for more details.';
+$string['auth_emailrecaptcha_key'] = 'Enable reCAPTCHA element';
+$string['auth_emailsettings'] = 'Settings';
+$string['auth_emailupdatemessage'] = 'Dear $a->fullname,
+
+You have requested a change of your email address for your user account at $a->site. Please open the following URL in your browser in order to confirm this change.
+
+$a->url';
+$string['auth_emailupdatetitle'] = 'Confirmation of email update at $a->site';
+$string['auth_invalidnewemailkey'] = 'Error: if you are trying to confirm a change of email address, you may have made a mistake in copying the URL we sent you by email. Please copy the address and try again.';
+$string['auth_emailupdatesuccess'] = 'Your email address was successfully updated to $a->email.';
+$string['auth_outofnewemailupdateattempts'] = 'You have run out of allowed attempts to update your email address. Your update request has been cancelled.';
+$string['auth_emailupdate'] = 'Email address update';
+$string['auth_changingemailaddress'] = 'You have requested a change of email address, from $a->oldemail to $a->newemail. For security reasons, we are sending you an email message at the new address to confirm that it belongs to you. Your email address will be updated as soon as you open the URL sent to you in that message.';
// FirstClass plugin
$string['auth_fccreators'] = 'List of groups whose members are allowed to create new courses. Separate multiple groups with \';\'. Names must be spelled exactly as on FirstClass server. System is case-sensitive.';
@@ -179,11 +196,11 @@
$string['auth_ldap_version'] = 'The version of the LDAP protocol your server is using.';
$string['auth_ldapdescription'] = 'This method provides authentication against an external LDAP server.
- If the given username and password are valid, Moodle creates a new user
+ If the given username and password are valid, Moodle creates a new user
- entry in its database. This module can read user attributes from LDAP and prefill
+ entry in its database. This module can read user attributes from LDAP and prefill
- wanted fields in Moodle. For following logins only the username and
+ wanted fields in Moodle. For following logins only the username and
password are checked.';
$string['auth_ldap_ldap_encoding_key'] = 'LDAP encoding';
View
73 user/edit.php
@@ -10,6 +10,7 @@
$userid = optional_param('id', $USER->id, PARAM_INT); // user id
$course = optional_param('course', SITEID, PARAM_INT); // course id (defaults to Site)
+ $cancelemailchange = optional_param('cancelemailchange', false, PARAM_INT); // course id (defaults to Site)
if (!$course = get_record('course', 'id', $course)) {
error('Course ID was incorrect');
@@ -32,11 +33,34 @@
error('User ID was incorrect');
}
+ // Process email change cancellation
+ if ($cancelemailchange) {
+ useredit_load_preferences($user);
+ $user->preference_newemail = null;
+ $user->preference_newemailkey = null;
+ $user->preference_newemailattemptsleft = null;
+ useredit_update_user_preference($user);
+ }
+
+ // Guest can not be edited
+ if (isguestuser($user)) {
+ print_error('guestnoeditprofile');
+ }
+
+ // User interests separated by commas
+ if (!empty($CFG->usetags)) {
+ require_once($CFG->dirroot.'/tag/lib.php');
+ $user->interests = tag_get_tags_csv('user', $user->id, TAG_RETURN_TEXT);
+ }
+
// remote users cannot be edited
if (is_mnet_remote_user($user)) {
redirect($CFG->wwwroot . "/user/view.php?course={$course->id}");
}
+ $systemcontext = get_context_instance(CONTEXT_SYSTEM);
+ $personalcontext = get_context_instance(CONTEXT_USER, $user->id);
+
// check access control
if ($user->id != $USER->id) {
// teachers, parents, etc.
@@ -63,9 +87,28 @@
$userform = new user_edit_form();
$userform->set_data($user);
+ $email_changed = false;
+
if ($usernew = $userform->get_data()) {
add_to_log($course->id, 'user', 'update', "view.php?id=$user->id&course=$course->id", '');
+ $email_changed_html = '';
+
+ if ($CFG->emailchangeconfirmation) {
+ // Handle change of email carefully for non-trusted users
+ if ($user->email != $usernew->email && !has_capability('moodle/user:update', $systemcontext)) {
+ $a = new stdClass();
+ $a->newemail = $usernew->preference_newemail = $usernew->email;
+ $usernew->preference_newemailkey = random_string(20);
+ $usernew->preference_newemailattemptsleft = 3;
+ $a->oldemail = $usernew->email = $user->email;
+
+ $email_changed_html = print_box(get_string('auth_changingemailaddress', 'auth', $a), 'generalbox', 'notice', true);
+ $email_changed_html .= print_continue("$CFG->wwwroot/user/view.php?id=$user->id&amp;course=$course->id", true);
+ $email_changed = true;
+ }
+ }
+
$authplugin = get_auth_plugin($user->auth);
$usernew->timemodified = time();
@@ -99,6 +142,24 @@
// save custom profile fields data
profile_save_data($usernew);
+ // If email was changed, send confirmation email now
+ if ($email_changed && $CFG->emailchangeconfirmation) {
+ $temp_user = fullclone($user);
+ $temp_user->email = $usernew->preference_newemail;
+
+ $a = new stdClass();
+ $a->url = $CFG->wwwroot . '/user/emailupdate.php?key=' . $usernew->preference_newemailkey . '&id=' . $user->id;
+ $a->site = $SITE->fullname;
+ $a->fullname = fullname($user, true);
+
+ $emailupdatemessage = get_string('auth_emailupdatemessage', 'auth', $a);
+ $emailupdatetitle = get_string('auth_emailupdatetitle', 'auth', $a);
+
+ if(!$mail_results = email_to_user($temp_user, get_admin(), $emailupdatetitle, $emailupdatemessage)) {
+ die("could not send email!");
+ }
+ }
+
if ($USER->id == $user->id) {
// Override old $USER session variable if needed
$usernew = (array)get_record('user', 'id', $user->id); // reload from db
@@ -107,7 +168,9 @@
}
}
- redirect("$CFG->wwwroot/user/view.php?id=$user->id&course=$course->id");
+ if (!$email_changed || !$CFG->emailchangeconfirmation) {
+ redirect("$CFG->wwwroot/user/view.php?id=$user->id&course=$course->id");
+ }
}
@@ -131,8 +194,12 @@
$currenttab = 'editprofile';
require('tabs.php');
-/// Finally display THE form
- $userform->display();
+ if ($email_changed) {
+ echo $email_changed_html;
+ } else {
+ /// Finally display THE form
+ $userform->display();
+ }
/// and proper footer
print_footer($course);
View
18 user/editlib.php
@@ -55,7 +55,10 @@ function useredit_update_trackforums($user, $usernew) {
}
function useredit_shared_definition(&$mform) {
- global $CFG;
+ global $CFG, $USER;
+
+ $user = get_record('user', 'id', $USER->id);
+ useredit_load_preferences($user);
$strrequired = get_string('required');
@@ -67,8 +70,17 @@ function useredit_shared_definition(&$mform) {
$mform->addRule('lastname', $strrequired, 'required', null, 'client');
$mform->setType('lastname', PARAM_NOTAGS);
- $mform->addElement('text', 'email', get_string('email'), 'maxlength="100" size="30"');
- $mform->addRule('email', $strrequired, 'required', null, 'client');
+ // Do not show email field if change confirmation is pending
+ if ($CFG->emailchangeconfirmation && !empty($user->preference_newemail)) {
+ $notice = get_string('auth_emailchangepending', 'auth', $user);
+ $notice .= '<br /><a href="edit.php?cancelemailchange=1&amp;id='.$user->id.'">'
+ . get_string('auth_emailchangecancel', 'auth') . '</a>';
+ $mform->addElement('static', 'emailpending', get_string('email'), $notice);
+ } else {
+ $mform->addElement('text', 'email', get_string('email'), 'maxlength="100" size="30"');
+ $mform->addRule('email', $strrequired, 'required', null, 'client');
+ }
+
$choices = array();
$choices['0'] = get_string('emaildisplayno');
View
64 user/emailupdate.php
@@ -0,0 +1,64 @@
+<?php // $Id$
+require_once('../config.php');
+require_once($CFG->libdir.'/adminlib.php');
+
+$key = required_param('key', PARAM_ALPHANUM);
+$id = required_param('id', PARAM_INT);
+
+if (!$user = get_record('user', 'id', $id)) {
+ error("Unknown user ID");
+}
+
+$preferences = get_user_preferences(null, null, $id);
+$a = new stdClass();
+$a->fullname = fullname($user, true);
+$stremailupdate = get_string('auth_emailupdate', 'auth', $a);
+print_header(format_string($SITE->fullname) . ": $stremailupdate", format_string($SITE->fullname) . ": $stremailupdate");
+
+$cancel_email_update = false;
+
+if (empty($preferences['newemailattemptsleft'])) {
+ redirect("$CFG->wwwroot/user/view.php?id=$user->id");
+
+} elseif ($preferences['newemailattemptsleft'] < 1) {
+ $cancel_email_update = true;
+ $stroutofattempts = get_string('auth_outofnewemailupdateattempts', 'auth');
+ print_box($stroutofattempts, 'center');
+
+} elseif ($key == $preferences['newemailkey']) {
+ $user->email = $preferences['newemail'];
+
+ // Detect duplicate before saving
+ if (get_record('user', 'email', addslashes($user->email))) {
+ $stremailnowexists = get_string('auth_emailnowexists', 'auth');
+ print_box($stremailnowexists, 'center');
+ $cancel_email_update = true;
+ print_continue("$CFG->wwwroot/user/view.php?id=$user->id");
+ } else {
+ // update user email
+ if (!set_field('user', 'email', addslashes($user->email), 'id', $user->id)) {
+ error('Error updating user record');
+
+ } else {
+ $stremailupdatesuccess = get_string('auth_emailupdatesuccess', 'auth', $user);
+ print_box($stremailupdatesuccess, 'center');
+ print_continue("$CFG->wwwroot/user/view.php?id=$user->id");
+
+ $cancel_email_update = true;
+ }
+ }
+
+} else {
+ $preferences['newemailattemptsleft']--;
+ set_user_preference('newemailattemptsleft', $preferences['newemailattemptsleft'], $user->id);
+ $strinvalidkey = get_string('auth_invalidnewemailkey', 'auth');
+ print_box($strinvalidkey, 'center');
+}
+
+if ($cancel_email_update) {
+ require_once($CFG->dirroot . '/user/editlib.php');
+ $user->preference_newemail = null;
+ $user->preference_newemailkey = null;
+ $user->preference_newemailattemptsleft = null;
+ useredit_update_user_preference($user);
+}
View
2 version.php
@@ -6,7 +6,7 @@
// This is compared against the values stored in the database to determine
// whether upgrades should be performed (see lib/db/*.php)
- $version = 2007021550; // YYYYMMDD = date of the 1.8 branch (don't change)
+ $version = 2007021551; // YYYYMMDD = date of the 1.8 branch (don't change)
// X = release number 1.8.[0,1,2,3...]
// Y = micro-increments between releases

0 comments on commit f978083

Please sign in to comment.
Something went wrong with that request. Please try again.