diff --git a/modules/user/user.pages.inc b/modules/user/user.pages.inc index 7d40663..2a832ed 100644 --- a/modules/user/user.pages.inc +++ b/modules/user/user.pages.inc @@ -90,9 +90,10 @@ function user_pass_submit($form, &$form_state) { /** * Menu callback; process one time login link and redirects to the user page on success. */ -function user_pass_reset($form, &$form_state, $uid, $timestamp, $hashed_pass, $action = NULL) { +function user_pass_reset($form, &$form_state, $uid, $timestamp, $hashed_pass) { global $user; + // When processing the one-time login link, we have to make sure that a user // isn't already logged in. if ($user->uid) { @@ -104,11 +105,11 @@ function user_pass_reset($form, &$form_state, $uid, $timestamp, $hashed_pass, $a else { $reset_link_account = user_load($uid); if (!empty($reset_link_account)) { - drupal_set_message(t('Another user (%other_user) is already logged into the site on this computer, but you tried to use a one-time link for user %resetting_user. Please logout and try using the link again.', + drupal_set_message(t('Another user (%other_user) is already logged into the site on this computer, but you tried to use a reset password link for user %resetting_user. Please logout and try using the link again.', array('%other_user' => $user->name, '%resetting_user' => $reset_link_account->name, '!logout' => url('user/logout')))); } else { // Invalid one-time link specifies an unknown user. - drupal_set_message(t('The one-time login link you clicked is invalid.')); + drupal_set_message(t('The reset password link you clicked is invalid.')); } } drupal_goto(); @@ -123,35 +124,14 @@ function user_pass_reset($form, &$form_state, $uid, $timestamp, $hashed_pass, $a if ($timestamp <= $current && $account = reset($users)) { // No time out for first time login. if ($account->login && $current - $timestamp > $timeout) { - drupal_set_message(t('You have tried to use a one-time login link that has expired. Please request a new one using the form below.')); + drupal_set_message(t('You have tried to use a reset password link that has expired. Please request a new one using the form below.')); drupal_goto('user/password'); } elseif ($account->uid && $timestamp >= $account->login && $timestamp <= $current && $hashed_pass == user_pass_rehash($account->pass, $timestamp, $account->login)) { - // First stage is a confirmation form, then login - if ($action == 'login') { - // Set the new user. - $user = $account; - // user_login_finalize() also updates the login timestamp of the - // user, which invalidates further use of the one-time login link. - user_login_finalize(); - watchdog('user', 'User %name used one-time login link at time %timestamp.', array('%name' => $account->name, '%timestamp' => $timestamp)); - drupal_set_message(t('You have just used your one-time login link. It is no longer necessary to use this link to log in. Please change your password.')); - // Let the user's password be changed without the current password check. - $token = drupal_random_key(); - $_SESSION['pass_reset_' . $user->uid] = $token; - drupal_goto('user/' . $user->uid . '/edit', array('query' => array('pass-reset-token' => $token))); - } - else { - $form['message'] = array('#markup' => t('

This is a one-time login for %user_name and will expire on %expiration_date.

Click on this button to log in to the site and change your password.

', array('%user_name' => $account->name, '%expiration_date' => format_date($timestamp + $timeout)))); - $form['help'] = array('#markup' => '

' . t('This login can be used only once.') . '

'); - $form['actions'] = array('#type' => 'actions'); - $form['actions']['submit'] = array('#type' => 'submit', '#value' => t('Log in')); - $form['#action'] = url("user/reset/$uid/$timestamp/$hashed_pass/login"); - return $form; - } + return _user_pass_reset_form($account, $timestamp); } else { - drupal_set_message(t('You have tried to use a one-time login link that has either been used or is no longer valid. Please request a new one using the form below.')); + drupal_set_message(t('You have tried to use a reset password link that has either been used or is no longer valid. Please request a new one using the form below.')); drupal_goto('user/password'); } } @@ -165,6 +145,60 @@ function user_pass_reset($form, &$form_state, $uid, $timestamp, $hashed_pass, $a } /** + * Generate the form to change password and log in using a one-time login link. + * + * @param stdClass $account + * This account will be logged in after a password change. + * @param $expire + * The timestamp when the login link expires. Used only to display. + */ +function _user_pass_reset_form($account, $expire) { + //drupal_set_message('
' . print_r($account, 1) . '
'); + + //If user has never logged in, they are "creating" a password. + if ($account->login == 0){ + drupal_set_title(t('Create Password')); + } + + $form['message'] = array( + '#type' => 'html_tag', + '#tag' => 'p', + '#value' => t('Create a new password for your @s account using the form below.', array('@s' => variable_get('site_name', 'Drupal'))), + ); + $form['name'] = array( + '#type' => 'item', + '#title' => t('Username'), + '#markup' => $account->name .' '. l(t('Not You?'), 'user/password'), + ); + $form['pass'] = array( + '#type' => 'password_confirm', + '#required' => TRUE + ); + $form['submit'] = array( + '#type' => 'submit', + '#value' => t('@change password and log in', array('@change' => $account->login == 0? t('Create'): t('Change'))), + ); + $form['#account'] = $account; + $form['#redirect'] = "user/$account->uid"; + return $form; +} + +/** + * Change password and log in the user. + */ +function user_pass_reset_submit($form, $form_state) { + global $user; + watchdog('user', 'User %name used one-time login link at time %timestamp.', array('%name' => $form['#account']->name, '%timestamp' => REQUEST_TIME)); + // Set the new user. + $user = $form['#account']; + user_save($user, array('pass' => $form_state['values']['pass'])); + drupal_set_message(t('Your password has been changed.')); + // user_login_finalize() also updates the login timestamp of the + // user, which invalidates further use of the one-time login link. + user_login_finalize(); +} + +/** * Menu callback; logs the current user out, and redirects to the home page. */ function user_logout() {