MediaWiki  master
SpecialChangeEmail.php
Go to the documentation of this file.
1 <?php
27 
37  private $status;
38 
40  private $permManager;
41 
46  parent::__construct( 'ChangeEmail', 'editmyprivateinfo' );
47 
48  $this->permManager = $permManager;
49  }
50 
51  public function doesWrites() {
52  return true;
53  }
54 
58  public function isListed() {
59  return MediaWikiServices::getInstance()->getAuthManager()
60  ->allowsPropertyChange( 'emailaddress' );
61  }
62 
67  public function execute( $par ) {
68  $out = $this->getOutput();
69  $out->disallowUserJs();
70 
71  parent::execute( $par );
72  }
73 
74  protected function getLoginSecurityLevel() {
75  return $this->getName();
76  }
77 
78  protected function checkExecutePermissions( User $user ) {
79  $services = MediaWikiServices::getInstance();
80  if ( !$services->getAuthManager()->allowsPropertyChange( 'emailaddress' ) ) {
81  throw new ErrorPageError( 'changeemail', 'cannotchangeemail' );
82  }
83 
84  $this->requireLogin( 'changeemail-no-info' );
85 
86  // This could also let someone check the current email address, so
87  // require both permissions.
88  if ( !$this->permManager->userHasRight( $this->getUser(), 'viewmyprivateinfo' ) ) {
89  throw new PermissionsError( 'viewmyprivateinfo' );
90  }
91 
92  parent::checkExecutePermissions( $user );
93  }
94 
95  protected function getFormFields() {
96  $user = $this->getUser();
97 
98  $fields = [
99  'Name' => [
100  'type' => 'info',
101  'label-message' => 'username',
102  'default' => $user->getName(),
103  ],
104  'OldEmail' => [
105  'type' => 'info',
106  'label-message' => 'changeemail-oldemail',
107  'default' => $user->getEmail() ?: $this->msg( 'changeemail-none' )->text(),
108  ],
109  'NewEmail' => [
110  'type' => 'email',
111  'label-message' => 'changeemail-newemail',
112  'autofocus' => true,
113  'help-message' => 'changeemail-newemail-help',
114  ],
115  ];
116 
117  return $fields;
118  }
119 
120  protected function getDisplayFormat() {
121  return 'ooui';
122  }
123 
124  protected function alterForm( HTMLForm $form ) {
125  $form->setId( 'mw-changeemail-form' );
126  $form->setTableId( 'mw-changeemail-table' );
127  $form->setSubmitTextMsg( 'changeemail-submit' );
128  $form->addHiddenFields( $this->getRequest()->getValues( 'returnto', 'returntoquery' ) );
129 
130  $form->addHeaderText( $this->msg( 'changeemail-header' )->parseAsBlock() );
131  }
132 
133  public function onSubmit( array $data ) {
134  $status = $this->attemptChange( $this->getUser(), $data['NewEmail'] );
135 
136  $this->status = $status;
137 
138  return $status;
139  }
140 
141  public function onSuccess() {
142  $request = $this->getRequest();
143 
144  $returnto = $request->getVal( 'returnto' );
145  $titleObj = $returnto !== null ? Title::newFromText( $returnto ) : null;
146  if ( !$titleObj instanceof Title ) {
147  $titleObj = Title::newMainPage();
148  }
149  $query = $request->getVal( 'returntoquery' );
150 
151  if ( $this->status->value === true ) {
152  $this->getOutput()->redirect( $titleObj->getFullUrlForRedirect( $query ) );
153  } elseif ( $this->status->value === 'eauth' ) {
154  # Notify user that a confirmation email has been sent...
155  $this->getOutput()->wrapWikiMsg( "<div class='error' style='clear: both;'>\n$1\n</div>",
156  'eauthentsent', $this->getUser()->getName() );
157  // just show the link to go back
158  $this->getOutput()->addReturnTo( $titleObj, wfCgiToArray( $query ) );
159  }
160  }
161 
167  private function attemptChange( User $user, $newaddr ) {
168  if ( $newaddr != '' && !Sanitizer::validateEmail( $newaddr ) ) {
169  return Status::newFatal( 'invalidemailaddress' );
170  }
171 
172  $oldaddr = $user->getEmail();
173  if ( $newaddr === $oldaddr ) {
174  return Status::newFatal( 'changeemail-nochange' );
175  }
176 
177  // To prevent spam, rate limit adding a new address, but do
178  // not rate limit removing an address.
179  if ( $newaddr !== '' && $user->pingLimiter( 'changeemail' ) ) {
180  return Status::newFatal( 'actionthrottledtext' );
181  }
182 
183  $userLatest = $user->getInstanceForUpdate();
184  $status = $userLatest->setEmailWithConfirmation( $newaddr );
185  if ( !$status->isGood() ) {
186  return $status;
187  }
188 
189  LoggerFactory::getInstance( 'authentication' )->info(
190  'Changing email address for {user} from {oldemail} to {newemail}', [
191  'user' => $userLatest->getName(),
192  'oldemail' => $oldaddr,
193  'newemail' => $newaddr,
194  ]
195  );
196 
197  $this->getHookRunner()->onPrefsEmailAudit( $userLatest, $oldaddr, $newaddr );
198 
199  $userLatest->saveSettings();
200 
201  return $status;
202  }
203 
204  public function requiresUnblock() {
205  return false;
206  }
207 
208  protected function getGroupName() {
209  return 'users';
210  }
211 }
SpecialChangeEmail\requiresUnblock
requiresUnblock()
Whether this action cannot be executed by a blocked user.
Definition: SpecialChangeEmail.php:204
SpecialPage\msg
msg( $key,... $params)
Wrapper around wfMessage that sets the current context.
Definition: SpecialPage.php:828
Title\newFromText
static newFromText( $text, $defaultNamespace=NS_MAIN)
Create a new Title from text, such as what one would find in a link.
Definition: Title.php:328
StatusValue\newFatal
static newFatal( $message,... $parameters)
Factory function for fatal errors.
Definition: StatusValue.php:70
SpecialChangeEmail\$permManager
PermissionManager $permManager
Definition: SpecialChangeEmail.php:40
SpecialChangeEmail\doesWrites
doesWrites()
Indicates whether this special page may perform database writes.
Definition: SpecialChangeEmail.php:51
SpecialPage\getOutput
getOutput()
Get the OutputPage being used for this instance.
Definition: SpecialPage.php:744
MediaWiki\MediaWikiServices
MediaWikiServices is the service locator for the application scope of MediaWiki.
Definition: MediaWikiServices.php:157
SpecialChangeEmail\attemptChange
attemptChange(User $user, $newaddr)
Definition: SpecialChangeEmail.php:167
HTMLForm\addHeaderText
addHeaderText( $msg, $section=null)
Add HTML to the header, inside the form.
Definition: HTMLForm.php:819
SpecialChangeEmail\onSuccess
onSuccess()
Do something exciting on successful processing of the form, most likely to show a confirmation messag...
Definition: SpecialChangeEmail.php:141
SpecialChangeEmail\getLoginSecurityLevel
getLoginSecurityLevel()
Tells if the special page does something security-sensitive and needs extra defense against a stolen ...
Definition: SpecialChangeEmail.php:74
SpecialChangeEmail\checkExecutePermissions
checkExecutePermissions(User $user)
Called from execute() to check if the given user can perform this action.
Definition: SpecialChangeEmail.php:78
SpecialChangeEmail\alterForm
alterForm(HTMLForm $form)
Play with the HTMLForm if you need to more substantially.
Definition: SpecialChangeEmail.php:124
Sanitizer\validateEmail
static validateEmail( $addr)
Does a string look like an e-mail address?
Definition: Sanitizer.php:1711
FormSpecialPage
Special page which uses an HTMLForm to handle processing.
Definition: FormSpecialPage.php:31
PermissionsError
Show an error when a user tries to do something they do not have the necessary permissions for.
Definition: PermissionsError.php:31
Title\newMainPage
static newMainPage(MessageLocalizer $localizer=null)
Create a new Title for the Main Page.
Definition: Title.php:653
User\pingLimiter
pingLimiter( $action='edit', $incrBy=1)
Primitive rate limits: enforce maximum actions per time period to put a brake on flooding.
Definition: User.php:1642
SpecialPage\getName
getName()
Get the name of this Special Page.
Definition: SpecialPage.php:164
SpecialChangeEmail\__construct
__construct(PermissionManager $permManager)
Definition: SpecialChangeEmail.php:45
User\getInstanceForUpdate
getInstanceForUpdate()
Get a new instance of this user that was loaded from the master via a locking read.
Definition: User.php:4467
Status
Generic operation result class Has warning/error list, boolean status and arbitrary value.
Definition: Status.php:44
SpecialChangeEmail\getFormFields
getFormFields()
Get an HTMLForm descriptor array.
Definition: SpecialChangeEmail.php:95
User\getEmail
getEmail()
Get the user's e-mail address.
Definition: User.php:2471
StatusValue\isGood
isGood()
Returns whether the operation completed and didn't have any error or warnings.
Definition: StatusValue.php:122
SpecialPage\getHookRunner
getHookRunner()
Definition: SpecialPage.php:1011
MediaWiki\Logger\LoggerFactory
PSR-3 logger instance factory.
Definition: LoggerFactory.php:45
SpecialChangeEmail\$status
Status $status
Definition: SpecialChangeEmail.php:37
SpecialChangeEmail\execute
execute( $par)
Main execution point.
Definition: SpecialChangeEmail.php:67
SpecialChangeEmail\isListed
isListed()
Definition: SpecialChangeEmail.php:58
wfCgiToArray
wfCgiToArray( $query)
This is the logical opposite of wfArrayToCgi(): it accepts a query string as its argument and returns...
Definition: GlobalFunctions.php:391
SpecialPage\getUser
getUser()
Shortcut to get the User executing this instance.
Definition: SpecialPage.php:754
FormSpecialPage\$par
string null $par
The sub-page of the special page.
Definition: FormSpecialPage.php:36
SpecialPage\requireLogin
requireLogin( $reasonMsg='exception-nologin-text', $titleMsg='exception-nologin')
If the user is not logged in, throws UserNotLoggedIn error.
Definition: SpecialPage.php:373
MediaWiki\Permissions\PermissionManager
A service class for checking permissions To obtain an instance, use MediaWikiServices::getInstance()-...
Definition: PermissionManager.php:49
SpecialChangeEmail\getDisplayFormat
getDisplayFormat()
Get display format for the form.
Definition: SpecialChangeEmail.php:120
HTMLForm\setId
setId( $id)
Definition: HTMLForm.php:1543
SpecialChangeEmail
Let users change their email address.
Definition: SpecialChangeEmail.php:33
SpecialPage\getRequest
getRequest()
Get the WebRequest being used for this instance.
Definition: SpecialPage.php:734
SpecialChangeEmail\getGroupName
getGroupName()
Under which header this special page is listed in Special:SpecialPages See messages 'specialpages-gro...
Definition: SpecialChangeEmail.php:208
HTMLForm\setSubmitTextMsg
setSubmitTextMsg( $msg)
Set the text for the submit button to a message.
Definition: HTMLForm.php:1411
Title
Represents a title within MediaWiki.
Definition: Title.php:41
HTMLForm\addHiddenFields
addHiddenFields(array $fields)
Add an array of hidden fields to the output.
Definition: HTMLForm.php:974
SpecialChangeEmail\onSubmit
onSubmit(array $data)
Process the form on POST submission.
Definition: SpecialChangeEmail.php:133
HTMLForm\setTableId
setTableId( $id)
Set the id of the <table> or outermost <div> element.
Definition: HTMLForm.php:1532
ErrorPageError
An error page which can definitely be safely rendered using the OutputPage.
Definition: ErrorPageError.php:30
User
The User object encapsulates all of the user-specific settings (user_id, name, rights,...
Definition: User.php:55
HTMLForm
Object handling generic submission, CSRF protection, layout and other logic for UI forms in a reusabl...
Definition: HTMLForm.php:135