Merge https://github.com/splitbrain/dokuwiki into html_showrev_output

1 files changed, 88 insertions, 25 deletions

diff --git a/lib/plugins/usermanager/admin.php b/lib/plugins/usermanager/admin.php
index 156037f09..86562f1dd 100644
--- a/lib/plugins/usermanager/admin.php
+++ b/lib/plugins/usermanager/admin.php
@@ -53,14 +53,17 @@ class admin_plugin_usermanager extends DokuWiki_Admin_Plugin {
         }
 
         // attempt to retrieve any import failures from the session
-        if ($_SESSION['import_failures']){
+        if (!empty($_SESSION['import_failures'])){
             $this->_import_failures = $_SESSION['import_failures'];
         }
     }
 
-     /**
-      * Return prompt for admin menu
-      */
+    /**
+     * Return prompt for admin menu
+     *
+     * @param string $language
+     * @return string
+     */
     public function getMenuText($language) {
 
         if (!is_null($this->_auth))
@@ -71,6 +74,8 @@ class admin_plugin_usermanager extends DokuWiki_Admin_Plugin {
 
     /**
      * return sort order for position in admin menu
+     *
+     * @return int
      */
     public function getMenuSort() {
         return 2;
@@ -78,6 +83,8 @@ class admin_plugin_usermanager extends DokuWiki_Admin_Plugin {
 
     /**
      * Handle user request
+     *
+     * @return bool
      */
     public function handle() {
         global $INPUT;
@@ -128,6 +135,8 @@ class admin_plugin_usermanager extends DokuWiki_Admin_Plugin {
 
     /**
      * Output appropriate html
+     *
+     * @return bool
      */
     public function html() {
         global $ID;
@@ -277,6 +286,7 @@ class admin_plugin_usermanager extends DokuWiki_Admin_Plugin {
     protected function _htmlUserForm($cmd,$user='',$userdata=array(),$indent=0) {
         global $conf;
         global $ID;
+        global $lang;
 
         $name = $mail = $groups = '';
         $notes = array();
@@ -299,6 +309,7 @@ class admin_plugin_usermanager extends DokuWiki_Admin_Plugin {
 
         $this->_htmlInputField($cmd."_userid",    "userid",    $this->lang["user_id"],    $user,  $this->_auth->canDo("modLogin"), $indent+6);
         $this->_htmlInputField($cmd."_userpass",  "userpass",  $this->lang["user_pass"],  "",     $this->_auth->canDo("modPass"),  $indent+6);
+        $this->_htmlInputField($cmd."_userpass2", "userpass2", $lang["passchk"],          "",     $this->_auth->canDo("modPass"),  $indent+6);
         $this->_htmlInputField($cmd."_username",  "username",  $this->lang["user_name"],  $name,  $this->_auth->canDo("modName"),  $indent+6);
         $this->_htmlInputField($cmd."_usermail",  "usermail",  $this->lang["user_mail"],  $mail,  $this->_auth->canDo("modMail"),  $indent+6);
         $this->_htmlInputField($cmd."_usergroups","usergroups",$this->lang["user_groups"],$groups,$this->_auth->canDo("modGroups"),$indent+6);
@@ -358,7 +369,7 @@ class admin_plugin_usermanager extends DokuWiki_Admin_Plugin {
         $class = $cando ? '' : ' class="disabled"';
         echo str_pad('',$indent);
 
-        if($name == 'userpass'){
+        if($name == 'userpass' || $name == 'userpass2'){
             $fieldtype = 'password';
             $autocomp  = 'autocomplete="off"';
         }elseif($name == 'usermail'){
@@ -475,7 +486,7 @@ class admin_plugin_usermanager extends DokuWiki_Admin_Plugin {
         if (!checkSecurityToken()) return false;
         if (!$this->_auth->canDo('addUser')) return false;
 
-        list($user,$pass,$name,$mail,$grps) = $this->_retrieveUser();
+        list($user,$pass,$name,$mail,$grps,$passconfirm) = $this->_retrieveUser();
         if (empty($user)) return false;
 
         if ($this->_auth->canDo('modPass')){
@@ -486,6 +497,10 @@ class admin_plugin_usermanager extends DokuWiki_Admin_Plugin {
                     msg($this->lang['add_fail'], -1);
                     return false;
                 }
+            } else {
+                if (!$this->_verifyPassword($pass,$passconfirm)) {
+                    return false;
+                }
             }
         } else {
             if (!empty($pass)){
@@ -606,7 +621,7 @@ class admin_plugin_usermanager extends DokuWiki_Admin_Plugin {
         $oldinfo = $this->_auth->getUserData($olduser);
 
         // get new user data subject to change
-        list($newuser,$newpass,$newname,$newmail,$newgrps) = $this->_retrieveUser();
+        list($newuser,$newpass,$newname,$newmail,$newgrps,$passconfirm) = $this->_retrieveUser();
         if (empty($newuser)) return false;
 
         $changes = array();
@@ -625,27 +640,37 @@ class admin_plugin_usermanager extends DokuWiki_Admin_Plugin {
                 $changes['user'] = $newuser;
             }
         }
-
-        // generate password if left empty and notification is on
-        if($INPUT->has('usernotify') && empty($newpass)){
-            $newpass = auth_pwgen($olduser);
+        if ($this->_auth->canDo('modPass')) {
+            if ($newpass || $passconfirm) {
+                if ($this->_verifyPassword($newpass,$passconfirm)) {
+                    $changes['pass'] = $newpass;
+                } else {
+                    return false;
+                }
+            } else {
+                // no new password supplied, check if we need to generate one (or it stays unchanged)
+                if ($INPUT->has('usernotify')) {
+                    $changes['pass'] = auth_pwgen($olduser);
+                }
+            }
         }
 
-        if (!empty($newpass) && $this->_auth->canDo('modPass'))
-          $changes['pass'] = $newpass;
-        if (!empty($newname) && $this->_auth->canDo('modName') && $newname != $oldinfo['name'])
-          $changes['name'] = $newname;
-        if (!empty($newmail) && $this->_auth->canDo('modMail') && $newmail != $oldinfo['mail'])
-          $changes['mail'] = $newmail;
-        if (!empty($newgrps) && $this->_auth->canDo('modGroups') && $newgrps != $oldinfo['grps'])
-          $changes['grps'] = $newgrps;
+        if (!empty($newname) && $this->_auth->canDo('modName') && $newname != $oldinfo['name']) {
+            $changes['name'] = $newname;
+        }
+        if (!empty($newmail) && $this->_auth->canDo('modMail') && $newmail != $oldinfo['mail']) {
+            $changes['mail'] = $newmail;
+        }
+        if (!empty($newgrps) && $this->_auth->canDo('modGroups') && $newgrps != $oldinfo['grps']) {
+            $changes['grps'] = $newgrps;
+        }
 
         if ($ok = $this->_auth->triggerUserMod('modify', array($olduser, $changes))) {
             msg($this->lang['update_ok'],1);
 
-            if ($INPUT->has('usernotify') && $newpass) {
+            if ($INPUT->has('usernotify') && !empty($changes['pass'])) {
                 $notify = empty($changes['user']) ? $olduser : $newuser;
-                $this->_notifyUser($notify,$newpass);
+                $this->_notifyUser($notify,$changes['pass']);
             }
 
             // invalidate all sessions
@@ -686,6 +711,32 @@ class admin_plugin_usermanager extends DokuWiki_Admin_Plugin {
     }
 
     /**
+     * Verify password meets minimum requirements
+     * :TODO: extend to support password strength
+     *
+     * @param string  $password   candidate string for new password
+     * @param string  $confirm    repeated password for confirmation
+     * @return bool   true if meets requirements, false otherwise
+     */
+    protected function _verifyPassword($password, $confirm) {
+        global $lang;
+
+        if (empty($password) && empty($confirm)) {
+            return false;
+        }
+
+        if ($password !== $confirm) {
+            msg($lang['regbadpass'], -1);
+            return false;
+        }
+
+        // :TODO: test password for required strength
+
+        // if we make it this far the password is good
+        return true;
+    }
+
+    /**
      * Retrieve & clean user data from the form
      *
      * @param bool $clean whether the cleanUser method of the authentication backend is applied
@@ -696,11 +747,13 @@ class admin_plugin_usermanager extends DokuWiki_Admin_Plugin {
         global $auth;
         global $INPUT;
 
+        $user = array();
         $user[0] = ($clean) ? $auth->cleanUser($INPUT->str('userid')) : $INPUT->str('userid');
         $user[1] = $INPUT->str('userpass');
         $user[2] = $INPUT->str('username');
         $user[3] = $INPUT->str('usermail');
         $user[4] = explode(',',$INPUT->str('usergroups'));
+        $user[5] = $INPUT->str('userpass2');                // repeated password for confirmation
 
         $user[4] = array_map('trim',$user[4]);
         if($clean) $user[4] = array_map(array($auth,'cleanGroup'),$user[4]);
@@ -721,7 +774,7 @@ class admin_plugin_usermanager extends DokuWiki_Admin_Plugin {
         $this->_filter = array();
 
         if ($op == 'new') {
-            list($user,$pass,$name,$mail,$grps) = $this->_retrieveUser(false);
+            list($user,/* $pass */,$name,$mail,$grps) = $this->_retrieveUser(false);
 
             if (!empty($user)) $this->_filter['user'] = $user;
             if (!empty($name)) $this->_filter['name'] = $name;
@@ -773,6 +826,7 @@ class admin_plugin_usermanager extends DokuWiki_Admin_Plugin {
 
         $disabled = 'disabled="disabled"';
 
+        $buttons = array();
         $buttons['start'] = $buttons['prev'] = ($this->_start == 0) ? $disabled : '';
 
         if ($this->_user_total == -1) {
@@ -894,8 +948,8 @@ class admin_plugin_usermanager extends DokuWiki_Admin_Plugin {
      * Returns cleaned user data
      *
      * @param array $candidate raw values of line from input file
-     * @param $error
-     * @return array|bool cleaned data or false
+     * @param string $error
+     * @return array|false cleaned data or false
      */
     protected function _cleanImportUser($candidate, & $error){
         global $INPUT;
@@ -908,7 +962,7 @@ class admin_plugin_usermanager extends DokuWiki_Admin_Plugin {
         $INPUT->set('usergroups', $candidate[4]);
 
         $cleaned = $this->_retrieveUser();
-        list($user,$pass,$name,$mail,$grps) = $cleaned;
+        list($user,/* $pass */,$name,$mail,/* $grps */) = $cleaned;
         if (empty($user)) {
             $error = $this->lang['import_error_baduserid'];
             return false;
@@ -978,6 +1032,9 @@ class admin_plugin_usermanager extends DokuWiki_Admin_Plugin {
 
     /**
      * wrapper for is_uploaded_file to facilitate overriding by test suite
+     *
+     * @param string $file filename
+     * @return bool
      */
     protected function _isUploadedFile($file) {
         return is_uploaded_file($file);
@@ -988,6 +1045,9 @@ class admin_plugin_usermanager extends DokuWiki_Admin_Plugin {
      *
      * @deprecated    remove when dokuwiki php requirement increases to 5.3+
      *                also associated unit test & mock access method
+     *
+     * @param string $csv string to parse
+     * @return array
      */
     protected function _getcsv($csv) {
         return function_exists('str_getcsv') ? str_getcsv($csv) : $this->str_getcsv($csv);
@@ -998,6 +1058,9 @@ class admin_plugin_usermanager extends DokuWiki_Admin_Plugin {
      * loosely based on www.php.net/str_getcsv#88311
      *
      * @deprecated    remove when dokuwiki php requirement increases to 5.3+
+     *
+     * @param string $str string to parse
+     * @return array
      */
     protected function str_getcsv($str) {
         $fp = fopen("php://temp/maxmemory:1048576", 'r+');    // 1MiB