disable OTP on user password reset

[tt-rss.git] / classes / pref / users.php

diff --git a/classes/pref/users.php b/classes/pref/users.php
index 60059dc8df30353710eba3628244e42b42b202b1..a5d48ac96ea8fa97b4676684ae67f950b0b3816c 100644 (file)
--- a/classes/pref/users.php
+++ b/classes/pref/users.php
@@ -12,7 +12,7 @@ class Pref_Users extends Handler_Protected {
                }
 
                function csrf_ignore($method) {
-                       $csrf_ignored = array("index");
+                       $csrf_ignored = array("index", "edit", "userdetails");
 
                        return array_search($method, $csrf_ignored) !== false;
                }
@@ -92,7 +92,7 @@ class Pref_Users extends Handler_Protected {
                        print "</ul>";
 
                        print "<div align='center'>
-                               <button onclick=\"closeInfoBox()\">".__("Close this window").
+                               <button dojoType=\"dijit.form.Button\" type=\"submit\">".__("Close this window").
                                "</button></div>";
 
                        return;
@@ -102,11 +102,11 @@ class Pref_Users extends Handler_Protected {
                        global $access_level_names;
 
                        $id = $this->dbh->escape_string($_REQUEST["id"]);
-                       print "<form id=\"user_edit_form\" onsubmit='return false'>";
+                       print "<form id=\"user_edit_form\" onsubmit='return false' dojoType=\"dijit.form.Form\">";
 
-                       print "<input type=\"hidden\" name=\"id\" value=\"$id\">";
-                       print "<input type=\"hidden\" name=\"op\" value=\"pref-users\">";
-                       print "<input type=\"hidden\" name=\"method\" value=\"editSave\">";
+                       print "<input dojoType=\"dijit.form.TextBox\" style=\"display : none\" name=\"id\" value=\"$id\">";
+                       print "<input dojoType=\"dijit.form.TextBox\" style=\"display : none\" name=\"op\" value=\"pref-users\">";
+                       print "<input dojoType=\"dijit.form.TextBox\" style=\"display : none\" name=\"method\" value=\"editSave\">";
 
                        $result = $this->dbh->query("SELECT * FROM ttrss_users WHERE id = '$id'");
 
@@ -120,16 +120,14 @@ class Pref_Users extends Handler_Protected {
                        print "<div class=\"dlgSecCont\">";
 
                        if ($sel_disabled) {
-                               print "<input type=\"hidden\" name=\"login\" value=\"$login\">";
-                               print "<input size=\"30\" style=\"font-size : 16px\"
-                                       onkeypress=\"return filterCR(event, userEditSave)\" $sel_disabled
-                                       value=\"$login\">";
-                       } else {
-                               print "<input size=\"30\" style=\"font-size : 16px\"
-                                       onkeypress=\"return filterCR(event, userEditSave)\" $sel_disabled
-                                       name=\"login\" value=\"$login\">";
+                               print "<input dojoType=\"dijit.form.TextBox\" style=\"display : none\" name=\"login\" value=\"$login\">";
                        }
 
+                       print "<input size=\"30\" style=\"font-size : 16px\"
+                               dojoType=\"dijit.form.ValidationTextBox\" required=\"1\"
+                               onkeypress=\"return filterCR(event, userEditSave)\" $sel_disabled
+                               name=\"login\" value=\"$login\">";
+
                        print "</div>";
 
                        print "<div class=\"dlgSec\">".__("Authentication")."</div>";
@@ -139,17 +137,16 @@ class Pref_Users extends Handler_Protected {
 
                        if (!$sel_disabled) {
                                print_select_hash("access_level", $access_level, $access_level_names,
-                                       $sel_disabled);
+                                       "dojoType=\"dijit.form.Select\" $sel_disabled");
                        } else {
                                print_select_hash("", $access_level, $access_level_names,
-                                       $sel_disabled);
-                               print "<input type=\"hidden\" name=\"access_level\" value=\"$access_level\">";
+                                       "dojoType=\"dijit.form.Select\" $sel_disabled");
+                               print "<input dojoType=\"dijit.form.TextBox\" style=\"display : none\" name=\"access_level\" value=\"$access_level\">";
                        }
 
-                       print "<br/>";
+                       print "<hr/>";
 
-                       print __('Change password to') .
-                               " <input type=\"password\" size=\"20\" onkeypress=\"return filterCR(event, userEditSave)\"
+                       print "<input dojoType=\"dijit.form.TextBox\" type=\"password\" size=\"20\" onkeypress=\"return filterCR(event, userEditSave)\" placeholder=\"Change password\"
                                name=\"password\">";
 
                        print "</div>";
@@ -157,8 +154,7 @@ class Pref_Users extends Handler_Protected {
                        print "<div class=\"dlgSec\">".__("Options")."</div>";
                        print "<div class=\"dlgSecCont\">";
 
-                       print __('E-mail: ').
-                               " <input size=\"30\" name=\"email\" onkeypress=\"return filterCR(event, userEditSave)\"
+                       print "<input dojoType=\"dijit.form.TextBox\" size=\"30\" name=\"email\" onkeypress=\"return filterCR(event, userEditSave)\" placeholder=\"E-mail\"
                                value=\"$email\">";
 
                        print "</div>";
@@ -168,9 +164,9 @@ class Pref_Users extends Handler_Protected {
                        print "</form>";
 
                        print "<div class=\"dlgButtons\">
-                               <button onclick=\"return userEditSave()\">".
+                               <button dojoType=\"dijit.form.Button\" type=\"submit\">".
                                        __('Save')."</button>
-                               <button onclick=\"return userEditCancel()\">".
+                               <button dojoType=\"dijit.form.Button\" onclick=\"dijit.byId('userEditDlg').hide()\">".
                                        __('Cancel')."</button></div>";
 
                        return;
@@ -262,7 +258,7 @@ class Pref_Users extends Handler_Protected {
 
                        $pwd_hash = encrypt_password($tmp_user_pwd, $new_salt, true);
 
-                       db_query("UPDATE ttrss_users SET pwd_hash = '$pwd_hash', salt = '$new_salt'
+                       db_query("UPDATE ttrss_users SET pwd_hash = '$pwd_hash', salt = '$new_salt', otp_enabled = false
                                WHERE id = '$uid'");
 
                        if ($show_password) {
@@ -324,7 +320,7 @@ class Pref_Users extends Handler_Protected {
                        print "<div style='float : right; padding-right : 4px;'>
                                <input dojoType=\"dijit.form.TextBox\" id=\"user_search\" size=\"20\" type=\"search\"
                                        value=\"$user_search\">
-                               <button dojoType=\"dijit.form.Button\" onclick=\"javascript:updateUsersList()\">".
+                               <button dojoType=\"dijit.form.Button\" onclick=\"updateUsersList()\">".
                                        __('Search')."</button>
                                </div>";
 
@@ -343,18 +339,21 @@ class Pref_Users extends Handler_Protected {
                                dojoType=\"dijit.MenuItem\">".__('None')."</div>";
                        print "</div></div>";
 
-                       print "<button dojoType=\"dijit.form.Button\" onclick=\"javascript:addUser()\">".__('Create user')."</button>";
+                       print "<button dojoType=\"dijit.form.Button\" onclick=\"addUser()\">".__('Create user')."</button>";
 
                        print "
-                               <button dojoType=\"dijit.form.Button\" onclick=\"javascript:selectedUserDetails()\">".
+                               <button dojoType=\"dijit.form.Button\" onclick=\"selectedUserDetails()\">".
                                __('Details')."</button dojoType=\"dijit.form.Button\">
-                               <button dojoType=\"dijit.form.Button\" onclick=\"javascript:editSelectedUser()\">".
+                               <button dojoType=\"dijit.form.Button\" onclick=\"editSelectedUser()\">".
                                __('Edit')."</button dojoType=\"dijit.form.Button\">
-                               <button dojoType=\"dijit.form.Button\" onclick=\"javascript:removeSelectedUsers()\">".
+                               <button dojoType=\"dijit.form.Button\" onclick=\"removeSelectedUsers()\">".
                                __('Remove')."</button dojoType=\"dijit.form.Button\">
-                               <button dojoType=\"dijit.form.Button\" onclick=\"javascript:resetSelectedUserPass()\">".
+                               <button dojoType=\"dijit.form.Button\" onclick=\"resetSelectedUserPass()\">".
                                __('Reset password')."</button dojoType=\"dijit.form.Button\">";
 
+                       PluginHost::getInstance()->run_hooks(PluginHost::HOOK_PREFS_TAB_SECTION,
+                               "hook_prefs_tab_section", "prefUsersToolbar");
+
                        print "</div>"; #toolbar
                        print "</div>"; #pane
                        print "<div id=\"pref-user-content\" dojoType=\"dijit.layout.ContentPane\" region=\"center\">";
@@ -419,7 +418,7 @@ class Pref_Users extends Handler_Protected {
 
                                $onclick = "onclick='editUser($uid, event)' title='".__('Click to edit')."'";
 
-                               print "<td $onclick>" . $line["login"] . "</td>";
+                               print "<td $onclick><img src='images/user.png' class='markedPic' alt=''> " . $line["login"] . "</td>";
 
                                if (!$line["email"]) $line["email"] = "&nbsp;";