MediaWiki  master
SpecialChangeEmail.php
Go to the documentation of this file.
1 <?php
26 
36  private $status;
37 
38  public function __construct() {
39  parent::__construct( 'ChangeEmail', 'editmyprivateinfo' );
40  }
41 
42  public function doesWrites() {
43  return true;
44  }
45 
49  public function isListed() {
50  return MediaWikiServices::getInstance()->getAuthManager()
51  ->allowsPropertyChange( 'emailaddress' );
52  }
53 
58  public function execute( $par ) {
59  $out = $this->getOutput();
60  $out->disallowUserJs();
61 
62  parent::execute( $par );
63  }
64 
65  protected function getLoginSecurityLevel() {
66  return $this->getName();
67  }
68 
69  protected function checkExecutePermissions( User $user ) {
70  $services = MediaWikiServices::getInstance();
71  if ( !$services->getAuthManager()->allowsPropertyChange( 'emailaddress' ) ) {
72  throw new ErrorPageError( 'changeemail', 'cannotchangeemail' );
73  }
74 
75  $this->requireLogin( 'changeemail-no-info' );
76 
77  // This could also let someone check the current email address, so
78  // require both permissions.
79  if ( !$services->getPermissionManager()
80  ->userHasRight( $this->getUser(), 'viewmyprivateinfo' )
81  ) {
82  throw new PermissionsError( 'viewmyprivateinfo' );
83  }
84 
85  parent::checkExecutePermissions( $user );
86  }
87 
88  protected function getFormFields() {
89  $user = $this->getUser();
90 
91  $fields = [
92  'Name' => [
93  'type' => 'info',
94  'label-message' => 'username',
95  'default' => $user->getName(),
96  ],
97  'OldEmail' => [
98  'type' => 'info',
99  'label-message' => 'changeemail-oldemail',
100  'default' => $user->getEmail() ?: $this->msg( 'changeemail-none' )->text(),
101  ],
102  'NewEmail' => [
103  'type' => 'email',
104  'label-message' => 'changeemail-newemail',
105  'autofocus' => true,
106  'help-message' => 'changeemail-newemail-help',
107  ],
108  ];
109 
110  return $fields;
111  }
112 
113  protected function getDisplayFormat() {
114  return 'ooui';
115  }
116 
117  protected function alterForm( HTMLForm $form ) {
118  $form->setId( 'mw-changeemail-form' );
119  $form->setTableId( 'mw-changeemail-table' );
120  $form->setSubmitTextMsg( 'changeemail-submit' );
121  $form->addHiddenFields( $this->getRequest()->getValues( 'returnto', 'returntoquery' ) );
122 
123  $form->addHeaderText( $this->msg( 'changeemail-header' )->parseAsBlock() );
124  }
125 
126  public function onSubmit( array $data ) {
127  $status = $this->attemptChange( $this->getUser(), $data['NewEmail'] );
128 
129  $this->status = $status;
130 
131  return $status;
132  }
133 
134  public function onSuccess() {
135  $request = $this->getRequest();
136 
137  $returnto = $request->getVal( 'returnto' );
138  $titleObj = $returnto !== null ? Title::newFromText( $returnto ) : null;
139  if ( !$titleObj instanceof Title ) {
140  $titleObj = Title::newMainPage();
141  }
142  $query = $request->getVal( 'returntoquery' );
143 
144  if ( $this->status->value === true ) {
145  $this->getOutput()->redirect( $titleObj->getFullUrlForRedirect( $query ) );
146  } elseif ( $this->status->value === 'eauth' ) {
147  # Notify user that a confirmation email has been sent...
148  $this->getOutput()->wrapWikiMsg( "<div class='error' style='clear: both;'>\n$1\n</div>",
149  'eauthentsent', $this->getUser()->getName() );
150  // just show the link to go back
151  $this->getOutput()->addReturnTo( $titleObj, wfCgiToArray( $query ) );
152  }
153  }
154 
160  private function attemptChange( User $user, $newaddr ) {
161  if ( $newaddr != '' && !Sanitizer::validateEmail( $newaddr ) ) {
162  return Status::newFatal( 'invalidemailaddress' );
163  }
164 
165  $oldaddr = $user->getEmail();
166  if ( $newaddr === $oldaddr ) {
167  return Status::newFatal( 'changeemail-nochange' );
168  }
169 
170  // To prevent spam, rate limit adding a new address, but do
171  // not rate limit removing an address.
172  if ( $newaddr !== '' && $user->pingLimiter( 'changeemail' ) ) {
173  return Status::newFatal( 'actionthrottledtext' );
174  }
175 
176  $userLatest = $user->getInstanceForUpdate();
177  $status = $userLatest->setEmailWithConfirmation( $newaddr );
178  if ( !$status->isGood() ) {
179  return $status;
180  }
181 
182  LoggerFactory::getInstance( 'authentication' )->info(
183  'Changing email address for {user} from {oldemail} to {newemail}', [
184  'user' => $userLatest->getName(),
185  'oldemail' => $oldaddr,
186  'newemail' => $newaddr,
187  ]
188  );
189 
190  $this->getHookRunner()->onPrefsEmailAudit( $userLatest, $oldaddr, $newaddr );
191 
192  $userLatest->saveSettings();
193 
194  return $status;
195  }
196 
197  public function requiresUnblock() {
198  return false;
199  }
200 
201  protected function getGroupName() {
202  return 'users';
203  }
204 }
SpecialChangeEmail\requiresUnblock
requiresUnblock()
Whether this action cannot be executed by a blocked user.
Definition: SpecialChangeEmail.php:197
SpecialPage\msg
msg( $key,... $params)
Wrapper around wfMessage that sets the current context.
Definition: SpecialPage.php:828
Title\newFromText
static newFromText( $text, $defaultNamespace=NS_MAIN)
Create a new Title from text, such as what one would find in a link.
Definition: Title.php:329
StatusValue\newFatal
static newFatal( $message,... $parameters)
Factory function for fatal errors.
Definition: StatusValue.php:70
SpecialChangeEmail\doesWrites
doesWrites()
Indicates whether this special page may perform database writes.
Definition: SpecialChangeEmail.php:42
SpecialPage\getOutput
getOutput()
Get the OutputPage being used for this instance.
Definition: SpecialPage.php:744
MediaWiki\MediaWikiServices
MediaWikiServices is the service locator for the application scope of MediaWiki.
Definition: MediaWikiServices.php:152
SpecialChangeEmail\attemptChange
attemptChange(User $user, $newaddr)
Definition: SpecialChangeEmail.php:160
HTMLForm\addHeaderText
addHeaderText( $msg, $section=null)
Add HTML to the header, inside the form.
Definition: HTMLForm.php:810
SpecialChangeEmail\onSuccess
onSuccess()
Do something exciting on successful processing of the form, most likely to show a confirmation messag...
Definition: SpecialChangeEmail.php:134
SpecialChangeEmail\getLoginSecurityLevel
getLoginSecurityLevel()
Tells if the special page does something security-sensitive and needs extra defense against a stolen ...
Definition: SpecialChangeEmail.php:65
SpecialChangeEmail\__construct
__construct()
Definition: SpecialChangeEmail.php:38
SpecialChangeEmail\checkExecutePermissions
checkExecutePermissions(User $user)
Called from execute() to check if the given user can perform this action.
Definition: SpecialChangeEmail.php:69
SpecialChangeEmail\alterForm
alterForm(HTMLForm $form)
Play with the HTMLForm if you need to more substantially.
Definition: SpecialChangeEmail.php:117
Sanitizer\validateEmail
static validateEmail( $addr)
Does a string look like an e-mail address?
Definition: Sanitizer.php:1984
FormSpecialPage
Special page which uses an HTMLForm to handle processing.
Definition: FormSpecialPage.php:31
PermissionsError
Show an error when a user tries to do something they do not have the necessary permissions for.
Definition: PermissionsError.php:31
Title\newMainPage
static newMainPage(MessageLocalizer $localizer=null)
Create a new Title for the Main Page.
Definition: Title.php:654
User\pingLimiter
pingLimiter( $action='edit', $incrBy=1)
Primitive rate limits: enforce maximum actions per time period to put a brake on flooding.
Definition: User.php:1767
SpecialPage\getName
getName()
Get the name of this Special Page.
Definition: SpecialPage.php:164
User\getInstanceForUpdate
getInstanceForUpdate()
Get a new instance of this user that was loaded from the master via a locking read.
Definition: User.php:4605
Status
Generic operation result class Has warning/error list, boolean status and arbitrary value.
Definition: Status.php:44
SpecialChangeEmail\getFormFields
getFormFields()
Get an HTMLForm descriptor array.
Definition: SpecialChangeEmail.php:88
User\getEmail
getEmail()
Get the user's e-mail address.
Definition: User.php:2564
StatusValue\isGood
isGood()
Returns whether the operation completed and didn't have any error or warnings.
Definition: StatusValue.php:122
SpecialPage\getHookRunner
getHookRunner()
Definition: SpecialPage.php:1010
MediaWiki\Logger\LoggerFactory
PSR-3 logger instance factory.
Definition: LoggerFactory.php:45
SpecialChangeEmail\$status
Status $status
Definition: SpecialChangeEmail.php:36
SpecialChangeEmail\execute
execute( $par)
Main execution point.
Definition: SpecialChangeEmail.php:58
SpecialChangeEmail\isListed
isListed()
Definition: SpecialChangeEmail.php:49
wfCgiToArray
wfCgiToArray( $query)
This is the logical opposite of wfArrayToCgi(): it accepts a query string as its argument and returns...
Definition: GlobalFunctions.php:391
SpecialPage\getUser
getUser()
Shortcut to get the User executing this instance.
Definition: SpecialPage.php:754
FormSpecialPage\$par
string null $par
The sub-page of the special page.
Definition: FormSpecialPage.php:36
SpecialPage\requireLogin
requireLogin( $reasonMsg='exception-nologin-text', $titleMsg='exception-nologin')
If the user is not logged in, throws UserNotLoggedIn error.
Definition: SpecialPage.php:373
SpecialChangeEmail\getDisplayFormat
getDisplayFormat()
Get display format for the form.
Definition: SpecialChangeEmail.php:113
HTMLForm\setId
setId( $id)
Definition: HTMLForm.php:1520
SpecialChangeEmail
Let users change their email address.
Definition: SpecialChangeEmail.php:32
SpecialPage\getRequest
getRequest()
Get the WebRequest being used for this instance.
Definition: SpecialPage.php:734
SpecialChangeEmail\getGroupName
getGroupName()
Under which header this special page is listed in Special:SpecialPages See messages 'specialpages-gro...
Definition: SpecialChangeEmail.php:201
HTMLForm\setSubmitTextMsg
setSubmitTextMsg( $msg)
Set the text for the submit button to a message.
Definition: HTMLForm.php:1388
Title
Represents a title within MediaWiki.
Definition: Title.php:42
HTMLForm\addHiddenFields
addHiddenFields(array $fields)
Add an array of hidden fields to the output.
Definition: HTMLForm.php:964
SpecialChangeEmail\onSubmit
onSubmit(array $data)
Process the form on POST submission.
Definition: SpecialChangeEmail.php:126
HTMLForm\setTableId
setTableId( $id)
Set the id of the <table> or outermost <div> element.
Definition: HTMLForm.php:1509
ErrorPageError
An error page which can definitely be safely rendered using the OutputPage.
Definition: ErrorPageError.php:30
User
The User object encapsulates all of the user-specific settings (user_id, name, rights,...
Definition: User.php:59
HTMLForm
Object handling generic submission, CSRF protection, layout and other logic for UI forms in a reusabl...
Definition: HTMLForm.php:133