From 14af18cb1b81e5dcee70c9eccb35d19f17af6948 Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Fri, 14 Oct 2011 16:23:16 +0200 Subject: [PATCH] [ticket/9361] View correct error messages when editing account information Currently the "current password" is only checked, when you change something. This means you get "Your profile has been updated." although you enter a wrong password. I also added proper error messages, when you leave the confirm fields empty, and sorted them in the order of the field appearances on the html page. PHPBB3-9361 --- phpBB/includes/ucp/ucp_profile.php | 12 ++++++------ phpBB/language/en/ucp.php | 3 +++ 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/phpBB/includes/ucp/ucp_profile.php b/phpBB/includes/ucp/ucp_profile.php index c099e3b3fa..65b32bd0c4 100644 --- a/phpBB/includes/ucp/ucp_profile.php +++ b/phpBB/includes/ucp/ucp_profile.php @@ -78,14 +78,14 @@ class ucp_profile $error = validate_data($data, $check_ary); - if ($auth->acl_get('u_chgpasswd') && $data['new_password'] && $data['password_confirm'] != $data['new_password']) + if ($auth->acl_get('u_chgemail') && $data['email'] != $user->data['user_email'] && $data['email_confirm'] != $data['email']) { - $error[] = 'NEW_PASSWORD_ERROR'; + $error[] = ($data['email_confirm']) ? 'NEW_EMAIL_ERROR' : 'NEW_EMAIL_CONFIRM_EMPTY'; } - if (($data['new_password'] || ($auth->acl_get('u_chgemail') && $data['email'] != $user->data['user_email']) || ($data['username'] != $user->data['username'] && $auth->acl_get('u_chgname') && $config['allow_namechange'])) && !phpbb_check_hash($data['cur_password'], $user->data['user_password'])) + if ($auth->acl_get('u_chgpasswd') && $data['new_password'] && $data['password_confirm'] != $data['new_password']) { - $error[] = 'CUR_PASSWORD_ERROR'; + $error[] = ($data['password_confirm']) ? 'NEW_PASSWORD_ERROR' : 'NEW_PASSWORD_CONFIRM_EMPTY'; } // Only check the new password against the previous password if there have been no errors @@ -94,9 +94,9 @@ class ucp_profile $error[] = 'SAME_PASSWORD_ERROR'; } - if ($auth->acl_get('u_chgemail') && $data['email'] != $user->data['user_email'] && $data['email_confirm'] != $data['email']) + if (!phpbb_check_hash($data['cur_password'], $user->data['user_password'])) { - $error[] = 'NEW_EMAIL_ERROR'; + $error[] = ($data['cur_password']) ? 'CUR_PASSWORD_ERROR' : 'CUR_PASSWORD_EMPTY'; } if (!check_form_key('ucp_reg_details')) diff --git a/phpBB/language/en/ucp.php b/phpBB/language/en/ucp.php index c1e3c06c43..3ebc863447 100644 --- a/phpBB/language/en/ucp.php +++ b/phpBB/language/en/ucp.php @@ -138,6 +138,7 @@ $lang = array_merge($lang, array( 'CURRENT_IMAGE' => 'Current image', 'CURRENT_PASSWORD' => 'Current password', 'CURRENT_PASSWORD_EXPLAIN' => 'You must confirm your current password if you wish to change it, alter your e-mail address or username.', + 'CUR_PASSWORD_EMPTY' => 'You did not enter your current password.', 'CUR_PASSWORD_ERROR' => 'The current password you entered is incorrect.', 'CUSTOM_DATEFORMAT' => 'Custom…', @@ -268,9 +269,11 @@ $lang = array_merge($lang, array( 'MOVE_TO_FOLDER' => 'Move to folder', 'MOVE_UP' => 'Move up', + 'NEW_EMAIL_CONFIRM_EMPTY' => 'You did not enter a confirm e-mail address.', 'NEW_EMAIL_ERROR' => 'The e-mail addresses you entered do not match.', 'NEW_FOLDER_NAME' => 'New folder name', 'NEW_PASSWORD' => 'New password', + 'NEW_PASSWORD_CONFIRM_EMPTY' => 'You did not enter a confirm password.', 'NEW_PASSWORD_ERROR' => 'The passwords you entered do not match.', 'NOTIFY_METHOD' => 'Notification method', 'NOTIFY_METHOD_BOTH' => 'Both',