', - '#markup' => t('Password reset instructions will be mailed to %email. You must log out to use the password reset link in the e-mail.', array('%email' => $user->mail)), - '#suffix' => '
', + // When a user requests a password reset we check for username and email + // conflicts using a multistep form. + if (empty($form_state['step'])) { + $form_state['step'] = 1; + } + + if ($form_state['step'] == 1) { + $form['name'] = array( + '#type' => 'textfield', + '#title' => t('Username or e-mail address'), + '#size' => 60, + '#maxlength' => max(USERNAME_MAX_LENGTH, EMAIL_MAX_LENGTH), + '#required' => TRUE, + ); + // Allow logged in users to request this also. + if ($user->uid > 0) { + $form['name']['#type'] = 'value'; + $form['name']['#value'] = $user->mail; + $form['mail'] = array( + '#prefix' => '', + '#markup' => t('Password reset instructions will be mailed to %email. You must log out to use the password reset link in the e-mail.', array('%email' => $user->mail)), + '#suffix' => '
', + ); + } + } + else { + // Where there is a conflict between the username and email address for two + // users we supply both accounts as an option for the password reset. + $accounts = $form_state['storage']['accounts']; + $options = array(); + foreach ($accounts as $account) { + $label = t('Account name: @name', array('@name' => $account->name)); + if ($account->mail == $form_state['storage']['name']) { + $label .= '/ ' . t('Email address: @email', array('@email' => $account->mail)); + } + $options[$account->uid] = $label; + } + $form['choose_account'] = array( + '#type' => 'radios', + '#title' => t('Choose account'), + '#required' => TRUE, + '#prefix' => "" . t("There is a username conflict with the email address @email. Please select which account password to reset.", array('@email' => $form_state['storage']['name'])) . "
", + '#options' => $options, + '#default_value' => reset($accounts)->uid, ); + } $form['actions'] = array('#type' => 'actions'); - $form['actions']['submit'] = array('#type' => 'submit', '#value' => t('E-mail new password')); + if ($form_state['step'] == 2) { + $form['actions']['cancel'] = array( + '#type' => 'submit', + '#value' => t('Cancel'), + '#name' => 'cancel', + '#limit_validation_errors' => array(), + ); + } + $form['actions']['submit'] = array( + '#type' => 'submit', + '#value' => t('E-mail new password'), + '#name' => 'submit' + ); return $form; } function user_pass_validate($form, &$form_state) { - $name = trim($form_state['values']['name']); - // Try to load by email. - $users = user_load_multiple(array(), array('mail' => $name, 'status' => '1')); - $account = reset($users); - if (!$account) { - // No success, try to load by name. - $users = user_load_multiple(array(), array('name' => $name, 'status' => '1')); - $account = reset($users); - } - if (isset($account->uid)) { - form_set_value(array('#parents' => array('account')), $account, $form_state); - } - else { - form_set_error('name', t('Sorry, %name is not recognized as a user name or an e-mail address.', array('%name' => $name))); + if ($form_state['step'] == 1) { + $name = trim($form_state['values']['name']); + $accounts = array(); + // Try to load by email. + $users = user_load_multiple(array(), array('mail' => $name, 'status' => '1')); + $account_by_email = reset($users); + if ($account_by_email) { + $accounts[$account_by_email->uid] = $account_by_email; + } + // Also try to load by user name, but only when the user is not logged in. + global $user; + if ($user->uid == 0) { + $users = user_load_multiple(array(), array('name' => $name, 'status' => '1')); + $account_by_name = reset($users); + if ($account_by_name) { + $accounts[$account_by_name->uid] = $account_by_name; + } + } + if (!empty($accounts)) { + form_set_value(array('#parents' => array('accounts')), $accounts, $form_state); + } + else { + form_set_error('name', t('Sorry, %name is not recognized as a user name or an e-mail address.', array('%name' => $name))); + } } } function user_pass_submit($form, &$form_state) { global $language_interface; - $account = $form_state['values']['account']; - // Mail one time login URL and instructions using current language. - $mail = _user_mail_notify('password_reset', $account, $language_interface); - if (!empty($mail)) { - watchdog('user', 'Password reset instructions mailed to %name at %email.', array('%name' => $account->name, '%email' => $account->mail)); - drupal_set_message(t('Further instructions have been sent to your e-mail address.')); + if ($form_state['step'] == 1) { + $accounts = $form_state['values']['accounts']; + if (count($accounts) > 1) { + $form_state['step'] = 2; + $form_state['storage']['name'] = $form_state['values']['name']; + $form_state['storage']['accounts'] = $accounts; + $form_state['rebuild'] = TRUE; + } + else { + $account = reset($accounts); + } + } + else { + if ($form_state['clicked_button']['#name'] == 'submit') { + $chosen_account = $form_state['values']['choose_account']; + $account = $form_state['storage']['accounts'][$chosen_account]; + } + else { + $form_state['redirect'] = 'user/password'; + } } + if (isset($account)) { + // Mail one-time login URL and instructions using current language. + $mail = _user_mail_notify('password_reset', $account, $language_interface); + if (!empty($mail)) { + watchdog('user', 'Password reset instructions mailed to %name at %email.', array('%name' => $account->name, '%email' => $account->mail)); + drupal_set_message(t('Further instructions have been sent to your e-mail address.')); + } - $form_state['redirect'] = 'user'; + $form_state['redirect'] = 'user'; + } return; } diff --git a/core/modules/user/user.test b/core/modules/user/user.test index 95b3cce..2359c71 100644 --- a/core/modules/user/user.test +++ b/core/modules/user/user.test @@ -439,6 +439,86 @@ class UserLoginTestCase extends DrupalWebTestCase { } /** + * Tests resetting a user's password. + */ +class UserPasswordResetTestCase extends DrupalWebTestCase { + public static function getInfo() { + return array( + 'name' => 'Reset Password', + 'description' => 'Ensure that a user can propperly reset their password.', + 'group' => 'User', + ); + } + + /** + * Attempts to reset a password when an email address matches two accounts. + */ + function testUserPasswordResetDuplicateUsers() { + // Don't require email validation for new accounts. + variable_set('user_email_verification', FALSE); + + // Don't require admin approval for new accounts. + variable_set('user_register', USER_REGISTER_VISITORS); + + // Create a user to be duplicated. + $user_with_email = $this->drupalCreateUser(); + + // Create a new user with the email from the above as the user's name. + $edit = array(); + $edit['name'] = $user_with_email->mail; + $edit['mail'] = $this->randomName() . "@example.com"; + $edit['pass[pass1]'] = $new_pass = $this->randomName(); + $edit['pass[pass2]'] = $new_pass; + $this->drupalPost('user/register', $edit, t('Create new account')); + // For backward compatibility, registration with a username that conflicts + // with an email address of another account should be allowed. + $this->assertText(t('Registration successful. You are now logged in.'), t('Users are logged in after registering.')); + // The above logs in the user. Log out to test password reset. + $this->drupalLogout(); + + // Get the duplicate user. + $users = user_load_multiple(array(), array('name' => $edit['name'], 'status' => '1')); + $user_with_name = reset($users); + + + // Try and reset based on the duplicated email. + $edit = array(); + $edit['name'] = $user_with_email->mail; + $this->drupalPost('user/password', $edit, t('E-mail new password')); + // There should be a field prompting the user to pick and account. + $this->assertField('choose_account', 'User is prompted to pick an account when email matches two accounts.'); + // We should be sure to not expose another user's email to the user. + $this->assertNoText($user_with_name->mail, "Duplicated user's email is not exposed to the other user."); + + // Select the account with the username matching the entered email. + $edit = array(); + $edit['choose_account'] = $user_with_email->uid; + $this->drupalPost(NULL, $edit, t('E-mail new password')); + $this->assertText(t('Further instructions have been sent to your e-mail address.'), 'User is notified that password reset was sent.'); + + // Make sure that right user was sent a reset email. + $this->assertEqual(count($this->drupalGetMails(array('key' => 'password_reset', 'to' => $user_with_email->mail))), 1, 'The right user was sent a password reset mail.'); + // Make sure that the other user was not sent an email. + $this->assertEqual(count($this->drupalGetMails(array('key' => 'password_reset', 'to' => $user_with_name->mail))), 0, 'The other user was not sent a password reset mail.'); + + // If the user is logged in, they should not have to choose an account to + // reset their password. + $user_with_name->pass_raw = $new_pass; + $this->drupalLogin($user_with_name); + $this->drupalGet('user/password'); + // There should not be a form element for name. + $this->assertNoField('name', 'Duplicate user is not asked for a name when resetting password while logged in.'); + $this->drupalPost(NULL, array(), t('E-mail new password')); + // Make sure the user with the matching username was sent an email. + $this->assertText(t('Further instructions have been sent to your e-mail address.'), 'User is notified that password reset was sent when logged in.'); + $this->assertEqual(count($this->drupalGetMails(array('key' => 'password_reset', 'to' => $user_with_name->mail))), 1, 'The right user was sent a password reset mail when logged in.'); + // Make sure that the user with the matching email address was not sent an + // email. (An email was already sent to this user earlier.) + $this->assertEqual(count($this->drupalGetMails(array('key' => 'password_reset', 'to' => $user_with_email->mail))), 1, 'The other user was not sent a password reset mail when logged in.'); + } +} + +/** * Test cancelling a user. */ class UserCancelTestCase extends DrupalWebTestCase {