Merge branch '0.9.x' into 1.0.x

[quix0rs-gnu-social.git] / actions / recoverpassword.php

diff --git a/actions/recoverpassword.php b/actions/recoverpassword.php
index 620fe7eb8e20ed9c5f05f5615fe19356980e6cba..f9956897f69918f1efa634db6149c9f1a0452a4f 100644 (file)
--- a/actions/recoverpassword.php
+++ b/actions/recoverpassword.php
@@ -1,7 +1,7 @@
 <?php
 /*
- * Laconica - a distributed open-source microblogging tool
- * Copyright (C) 2008, Controlez-Vous, Inc.
+ * StatusNet - the distributed open-source microblogging tool
+ * Copyright (C) 2008, 2009, StatusNet, Inc.
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as published by
@@ -17,11 +17,11 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-if (!defined('LACONICA')) { exit(1); }
+if (!defined('STATUSNET') && !defined('LACONICA')) { exit(1); }
 
 # You have 24 hours to claim your password
 
-define(MAX_RECOVERY_TIME, 24 * 60 * 60);
+define('MAX_RECOVERY_TIME', 24 * 60 * 60);
 
 class RecoverpasswordAction extends Action
 {
@@ -149,13 +149,13 @@ class RecoverpasswordAction extends Action
             $this->elementStart('div', 'instructions');
             if ($this->mode == 'recover') {
                 $this->element('p', null,
-                               _('If you\'ve forgotten or lost your' .
+                               _('If you have forgotten or lost your' .
                                  ' password, you can get a new one sent to' .
-                                 ' the email address you have stored ' .
+                                 ' the email address you have stored' .
                                  ' in your account.'));
             } else if ($this->mode == 'reset') {
                 $this->element('p', null,
-                               _('You\'ve been identified. Enter a ' .
+                               _('You have been identified. Enter a' .
                                  ' new password below. '));
             }
             $this->elementEnd('div');
@@ -185,15 +185,18 @@ class RecoverpasswordAction extends Action
                                            'class' => 'form_settings',
                                            'action' => common_local_url('recoverpassword')));
         $this->elementStart('fieldset');
-        $this->element('legend', null, _('Password recover'));
+        $this->element('legend', null, _('Password recovery'));
         $this->elementStart('ul', 'form_data');
         $this->elementStart('li');
-        $this->input('nicknameoremail', _('Nickname or email'),
+        $this->input('nicknameoremail', _('Nickname or email address'),
                      $this->trimmed('nicknameoremail'),
                      _('Your nickname on this server, ' .
                         'or your registered email address.'));
         $this->elementEnd('li');
         $this->elementEnd('ul');
+        $this->element('input', array('name' => 'recover',
+                                      'type' => 'hidden',
+                                      'value' => _('Recover')));
         $this->submit('recover', _('Recover'));
         $this->elementEnd('fieldset');
         $this->elementEnd('form');
@@ -259,10 +262,20 @@ class RecoverpasswordAction extends Action
         # See if it's an unconfirmed email address
 
         if (!$user) {
-            $confirm_email = Confirm_address::staticGet('address', common_canonical_email($nore));
-            if ($confirm_email && $confirm_email->address_type == 'email') {
+            // Warning: it may actually be legit to have multiple folks
+            // who have claimed, but not yet confirmed, the same address.
+            // We'll only send to the first one that comes up.
+            $confirm_email = new Confirm_address();
+            $confirm_email->address = common_canonical_email($nore);
+            $confirm_email->address_type = 'email';
+            $confirm_email->find();
+            if ($confirm_email->fetch()) {
                 $user = User::staticGet($confirm_email->user_id);
+            } else {
+                $confirm_email = null;
             }
+        } else {
+            $confirm_email = null;
         }
 
         if (!$user) {
@@ -273,9 +286,11 @@ class RecoverpasswordAction extends Action
         # Try to get an unconfirmed email address if they used a user name
 
         if (!$user->email && !$confirm_email) {
-            $confirm_email = Confirm_address::staticGet('user_id', $user->id);
-            if ($confirm_email && $confirm_email->address_type != 'email') {
-                # Skip non-email confirmations
+            $confirm_email = new Confirm_address();
+            $confirm_email->user_id = $user->id;
+            $confirm_email->address_type = 'email';
+            $confirm_email->find();
+            if (!$confirm_email->fetch()) {
                 $confirm_email = null;
             }
         }
@@ -291,7 +306,7 @@ class RecoverpasswordAction extends Action
         $confirm->code = common_confirmation_code(128);
         $confirm->address_type = 'recover';
         $confirm->user_id = $user->id;
-        $confirm->address = (isset($user->email)) ? $user->email : $confirm_email->address;
+        $confirm->address = (!empty($user->email)) ? $user->email : $confirm_email->address;
 
         if (!$confirm->insert()) {
             common_log_db_error($confirm, 'INSERT', __FILE__);
@@ -316,7 +331,8 @@ class RecoverpasswordAction extends Action
         $body .= common_config('site', 'name');
         $body .= "\n";
 
-        mail_to_user($user, _('Password recovery requested'), $body, $confirm->address);
+        $headers = _mail_prepare_headers('recoverpassword', $user->nickname, $user->nickname);
+        mail_to_user($user, _('Password recovery requested'), $body, $headers, $confirm->address);
 
         $this->mode = 'sent';
         $this->msg = _('Instructions for recovering your password ' .