XWiki
ResetPasswordComplete
en
0
XWiki.ResetPassword
XWiki.Admin
XWiki.Admin
xwiki:XWiki.Admin
1219710939000
1219710939000
1219710939000
1.1

# $msg.get("xe.admin.passwordReset.step2.title")

Imported from XAR
false
xwiki/2.1
false
XWiki.XWikiRights
1
0
select
allow
allow
4
Allow/Deny
0
com.xpn.xwiki.objects.classes.BooleanClass
0
0
select
1
groups
1
Groups
0
5
0
1
com.xpn.xwiki.objects.classes.GroupsClass
0
0
select
1
levels
2
Levels
0
3
0
com.xpn.xwiki.objects.classes.LevelsClass
0
0
select
1
users
3
Users
0
5
0
1
com.xpn.xwiki.objects.classes.UsersClass
XWiki.ResetPasswordComplete
0
XWiki.XWikiRights
7fd88649-d66d-442a-bcee-bc4147e410a7
0 XWiki.XWikiAllGroup edit XWiki.XWikiGuest
XWiki.XWikiRights
1
0
select
allow
allow
4
Allow/Deny
0
com.xpn.xwiki.objects.classes.BooleanClass
0
0
select
1
groups
1
Groups
0
5
0
1
com.xpn.xwiki.objects.classes.GroupsClass
0
0
select
1
levels
2
Levels
0
3
0
com.xpn.xwiki.objects.classes.LevelsClass
0
0
select
1
users
3
Users
0
5
0
1
com.xpn.xwiki.objects.classes.UsersClass
XWiki.ResetPasswordComplete
1
XWiki.XWikiRights
e0264a66-4a10-4d7e-822e-6863e3caaa18
0 xwiki:XWiki.XWikiAllGroup edit
XWiki.XWikiRights
1
0
select
allow
allow
4
Allow/Deny
0
com.xpn.xwiki.objects.classes.BooleanClass
0
0
select
1
groups
1
Groups
0
5
0
1
com.xpn.xwiki.objects.classes.GroupsClass
0
0
select
1
levels
2
Levels
0
3
0
com.xpn.xwiki.objects.classes.LevelsClass
0
0
select
1
users
3
Users
0
5
0
1
com.xpn.xwiki.objects.classes.UsersClass
XWiki.ResetPasswordComplete
2
XWiki.XWikiRights
06daec64-228b-4da1-b7e6-b59d9624c856
1 XWiki.XWikiAllGroup view XWiki.XWikiGuest
{{velocity output="false"}} #** This page completes the password reset procedure. It works according to the next algorithm: 1. Verify that the correct verification URL is entered, by checking the 'u' and 'v' request parameters against the existing ResetPasswordRequest objects 2. Display a form requesting the new password 3. When receiving the new password via form submission, update the user object with the new password, and remove the ResetPasswordRequest object

URL parameters:

u = user account in the verification URL v = random verification string p = the new password p2 = the new password (for misspelling check)

!!!!! IMPORTANT !!!!!

This document requires programming rights, so always make sure it is saved by a user with programming rights, and that it is secured against unprivileged editing.

*### ## ## ## The name of the class used for storing password reset verification data. #set ($verifClass = 'XWiki.ResetPasswordRequestClass') ## ## START MACROS ## #** * Encrypt a string to get the value that would be stored inside a PasswordProperty field. * It is used to check if the unencrypted parameter from the URL is the value stored in the * ResetPasswordRequest object. * @param value The plaintext value to encrypt. * @param result The encrypted output. *# #macro(encrypt $value $result) #set ($result = $xwiki.getDocument($verifClass).getxWikiClass().getXWikiClass().get('verification').getPasswordHash($value)) #end ## ## #** * Verify that the request parameters are valid. * @param userName The user name (full document name) received in the URL. * @param validationString The unencrypted key that is stored in the ResetPasswordRequestClass object. * @param result A boolean where the validation result is returned. True if the request is valid, false otherwise. *# #macro(verifyRequest $userName $validationString $isValid) #set ($isValid = false) #if ($validationString != '' && $userName != '') #encrypt($validationString $result) #set ($encryptedValidationString = $result) #if ("$!xwiki.getDocument($userName).getObject($verifClass).getProperty('verification').getValue()" == $encryptedValidationString) #set ($isValid = true) #end #end #end ## ## #** * Displays the password reset form. * @param message An optional message to display, for example if the sent password is empty. * @param u The user account (full document name), which needs to be preserved. * @param v The validation string, which will be checked again upon receiving the form. *### #macro(displayForm $message $userName $validationString) #if ($message != '') {{warning}}$message{{/warning}} #end

{{html}} <form action="$doc.getURL()" method="post" class="xform third" onsubmit="if($('p').value == '') {alert('$msg.get('xe.admin.passwordReset.step2.error.emptyPassword')'); return false;} else if($('p').value != $('p2').value) {alert('$msg.get('xe.admin.passwordReset.step2.error.verificationMismatch')'); return false; }"> <div class="hidden"> <input type="hidden" name="form_token" value="$!{services.csrf.getToken()}" /> <input type="hidden" name="u" value="$!escapetool.xml($userName)"/> <input type="hidden" name="v" value="$!escapetool.xml($validationString)"/> </div> <dl> <dt><label for="p">$msg.get('xe.admin.passwordReset.step2.newPassword.label')</label></dt> <dd><input id="p" type="password" name="p" value="" size="20"/></dd> <dt><label for="p2">$msg.get('xe.admin.passwordReset.step2.newPasswordVerification.label')</label></dt> <dd><input id="p2" type="password" value="" name="p2" size="20"/></dd> </dl> <div class="buttons"> <span class="buttonwrapper"><input type="submit" value="$msg.get('xe.admin.passwordReset.step2.submit')" class="button"/></span> </div> </form> {{/html}}

#end ## ## END MACROS ## ## #set ($userName = "$!request.u") #set ($validationString = "$!request.v") #set ($password = "$!request.p") #set ($password2 = "$!request.p2") #verifyRequest($userName $validationString $isValid) {{/velocity}}

{{velocity}} ## ## ## First, check if the page has programming rights, as nothing works otherwise #if ($xwiki.hasProgrammingRights()) #if ($isValid) #set ($vuserDoc = $xwiki.getDocumentAsAuthor($userName)) #if ($request.getParameterMap().containsKey('p'))## Second step, set the user password #if($password == '') #displayForm($msg.get('xe.admin.passwordReset.step2.error.emptyPassword') $userName $validationString) #elseif($password != $password2) #displayForm($msg.get('xe.admin.passwordReset.step2.error.verificationMismatch') $userName $validationString) #else $vuserDoc.getObject('XWiki.XWikiUsers').set('password', $password) #set($discard = $vuserDoc.removeObjects($verifClass)) #set ($discard = $vuserDoc.saveAsAuthor($msg.get('xe.admin.passwordReset.step2.versionComment.passwordReset'), true)) {{info}}$msg.get('xe.admin.passwordReset.step2.success') [[$msg.get('xe.admin.passwordReset.step2.login')>>path:$xwiki.getURL('XWiki.XWikiLogin', 'login')]]{{/info}}

#end #else## First step, request the user password ## The user might not complete this step, and leave the URL in the (public) browser's ## history. Prevent reusing the URL by invalidating the initial verification URL and only ## post the new string in the hidden form data. #set ($validationString = $util.generateRandomString(30)) #set ($discard = $vuserDoc.getObject($verifClass).set('verification', $validationString)) #set ($discard = $vuserDoc.saveAsAuthor($msg.get('xe.admin.passwordReset.step2.versionComment.changeValidationKey'), true)) #displayForm('' $userName $validationString) #end #else

{{error}}$msg.get('xe.admin.passwordReset.step2.error.wrongParameters') [[$msg.get('xe.admin.passwordReset.step2.backToStep1')>>ResetPassword]]{{/error}}

#end ## ## Clear private variables, so that they cannot be accessed from the rest of the page (comments, panels...) #set ($validationString = '') #set ($password = '') #set ($password2 = '') ## ## #else## No programming rights, warn and exit

{{error}}$msg.get('xe.admin.passwordReset.step2.error.noProgrammingRights'){{/error}}

#end {{/velocity}}