Numerous fixes to upgrade scripts + eliminate ability of users to invalidate each others passwords

3 files changed, 24 insertions, 4 deletions

diff --git a/templates/change_password.tpl b/templates/change_password.tpl
index c91e41b..deebb7c 100644
--- a/templates/change_password.tpl
+++ b/templates/change_password.tpl
@@ -1,19 +1,23 @@
 <h1>{tr}Change password enforced{/tr}</h1>
 <form method="post" action="{$smarty.const.USERS_PKG_URL}change_password.php">
 <input type="hidden" name="login" value="{$userInfo.login}" />
+{if $userInfo.provpass}
+  <input type="hidden" name="provpass" value="{$userInfo.provpass|escape}" />
+{/if}
+
 <table class="panel">
 <tr>
   <td>{tr}User{/tr}:</td>
   <td><b>{$userInfo.login}</b></td>
 </tr>
-{if $userInfo.user_password}
-  <input type="hidden" name="oldpass" value="{$userInfo.user_password|escape}" /></td>
-{else}
+
+{if !$userInfo.provpass}
 <tr>
   <td>{tr}Old password{/tr}:</td>
   <td><input type="password" name="oldpass" /></td>
 </tr>     
 {/if}
+
 <tr>
   <td>{tr}New password{/tr}:</td>
   <td><input type="password" name="pass" /></td>
diff --git a/templates/password_reminder.tpl b/templates/password_reminder.tpl
index 803fb90..5fd2eaa 100644
--- a/templates/password_reminder.tpl
+++ b/templates/password_reminder.tpl
@@ -1,5 +1,21 @@
+{if $mail_provpass}
+{tr}Hi{/tr} {$mail_user},
+
+{tr}Someone from the internet address{/tr} {$smarty.server.REMOTE_ADDR} {tr}requested a reminder of the password for the account{/tr}: 
+{literal}   {/literal}	{$mail_user}
+
+{tr}You may use the following URL to reset your password for this account:{/tr} 
+
+{$mail_machine}?user={$mail_user}&pass={$mail_provpass}
+
+{tr}This link will remain active only for the next 3 days or until one of the following occurs:{/tr}
+{literal}   {/literal}	{tr}The first sucessful use of this link.{/tr}
+{literal}   {/literal}	{tr}Another password reset request is made.{/tr}
+
+{else}
 {tr}Hi{/tr} {$mail_user},
 
 {tr}Someone from the internet address{/tr} {$smarty.server.REMOTE_ADDR} {tr}requested a reminder of the password for the account{/tr}: {$mail_user}
 
 {tr}Since this is your registered email address we inform that the password for this account is:{/tr} {$mail_pass}
+{/if}
diff --git a/templates/user_validation_mail.tpl b/templates/user_validation_mail.tpl
index ea2179e..81daf86 100644
--- a/templates/user_validation_mail.tpl
+++ b/templates/user_validation_mail.tpl
@@ -1,6 +1,6 @@
 {tr}Hi{/tr} {$mail_user},
 
-{tr}you or someone registered this email address at{/tr} {$mail_site}
+{tr}You or someone registered this email address at{/tr} {$mail_site}
 
 {tr}If you want to be a registered user in this site you will have to use the following link to login for the first time:{/tr}