From 605dc1060554d272709a3c0c91030e358a5e7770 Mon Sep 17 00:00:00 2001
From: Ryan Lane <rlane@wikimedia.org>
Date: Wed, 27 Mar 2013 01:10:40 -0400
Subject: [PATCH] Add hook AbortChangePassword to Special:ChangePassword

Adds a consistent method for authentication extensions to block
password changing operations.

Change-Id: I3469e90a958c4fb0f24cafd67de5590d3cc2f075
---
 RELEASE-NOTES-1.21                          |    2 ++
 docs/hooks.txt                              |    6 ++++++
 includes/specials/SpecialChangePassword.php |    6 ++++++
 languages/messages/MessagesEn.php           |    1 +
 languages/messages/MessagesQqq.php          |    1 +
 5 files changed, 16 insertions(+), 0 deletions(-)

diff --git a/RELEASE-NOTES-1.21 b/RELEASE-NOTES-1.21
index 8844f9b..b3ad623 100644
--- a/RELEASE-NOTES-1.21
+++ b/RELEASE-NOTES-1.21
@@ -210,6 +210,8 @@ production.
 * (bug 45143) jquery.badge: Treat non-Latin variants of zero as zero as well.
 * (bug 46151) mwdocgen.php should not ignore exit code of doxygen command.
 * (bug 41889) Fix $.tablesorter rowspan exploding for complex cases.
+* Added AbortChangePassword hook to allow extensions to abort password changes from
+  Special:ChangePassword
 
 === API changes in 1.21 ===
 * prop=revisions can now report the contentmodel and contentformat.
diff --git a/docs/hooks.txt b/docs/hooks.txt
index c266dcc..93d222e 100644
--- a/docs/hooks.txt
+++ b/docs/hooks.txt
@@ -270,6 +270,12 @@ $reason: the reason for the move (added in 1.13)
 $user: the User object about to be created (read-only, incomplete)
 &$msg: out parameter: HTML to display on abort
 
+'AbortChangePassword': Return false to cancel password change.
+$user: the User object to which the password change is occuring
+$this->mOldpass: the old password provided by the user
+$newpass: the new password provided by the user
+&$abortMsg: the message identifier for abort reason
+
 'ActionBeforeFormDisplay': Before executing the HTMLForm object.
 $name: name of the action
 &$form: HTMLForm object
diff --git a/includes/specials/SpecialChangePassword.php b/includes/specials/SpecialChangePassword.php
index 73eb97f..e538cac 100644
--- a/includes/specials/SpecialChangePassword.php
+++ b/includes/specials/SpecialChangePassword.php
@@ -243,6 +243,12 @@ class SpecialChangePassword extends UnlistedSpecialPage {
 			throw new PasswordError( $this->msg( 'login-throttled' )->text() );
 		}
 
+		$abortMsg = 'resetpass-abort-generic';
+		if ( !wfRunHooks( 'AbortChangePassword', array( $user, $this->mOldpass, $newpass, &$abortMsg ) ) ) {
+			wfRunHooks( 'PrefsPasswordAudit', array( $user, $newpass, 'abortreset' ) );
+			throw new PasswordError( $this->msg( $abortMsg )->text() );
+		}
+
 		if( !$user->checkTemporaryPassword( $this->mOldpass ) && !$user->checkPassword( $this->mOldpass ) ) {
 			wfRunHooks( 'PrefsPasswordAudit', array( $user, $newpass, 'wrongpassword' ) );
 			throw new PasswordError( $this->msg( 'resetpass-wrong-oldpass' )->text() );
diff --git a/languages/messages/MessagesEn.php b/languages/messages/MessagesEn.php
index adac7e9..937e25f 100644
--- a/languages/messages/MessagesEn.php
+++ b/languages/messages/MessagesEn.php
@@ -1205,6 +1205,7 @@ To finish logging in, you must set a new password here:',
 'oldpassword'               => 'Old password:',
 'newpassword'               => 'New password:',
 'retypenew'                 => 'Retype new password:',
+'resetpass-abort-generic'   => 'Password change has been aborted by an extension.',
 'resetpass_submit'          => 'Set password and log in',
 'resetpass_success'         => 'Your password has been changed successfully!
 Now logging you in...',
diff --git a/languages/messages/MessagesQqq.php b/languages/messages/MessagesQqq.php
index 6644cf9..090f4f6 100644
--- a/languages/messages/MessagesQqq.php
+++ b/languages/messages/MessagesQqq.php
@@ -1208,6 +1208,7 @@ See also:
 'oldpassword' => "Used on the 'User profile' tab of 'my preferences'. This is the text next to an entry box for the old password in the 'change password' section.",
 'newpassword' => '{{Identical|New password}}',
 'retypenew' => "Appears on the 'User profile' tab of the 'Preferences' special page in the 'Change password' section. It appears next to the text box for entering the new password a second time.",
+'resetpass-abort-generic' => 'Generic error message shown on [[Special:ChangePassword]] when an extension aborts a password change from a hook.',
 'resetpass_submit' => 'Submit button on [[Special:ChangePassword]]',
 'resetpass_success' => 'Used in [[Special:ChangePassword]].',
 'resetpass_forbidden' => "Used as error message in changing password. Maybe the external auth plugin won't allow local password changes.",
-- 
1.7.6.1