Index: lams_admin/conf/language/lams/ApplicationResources_en_AU.properties =================================================================== diff -u -r62aaf160878735888d077bf28fac3c1989bb8fbd -r139e91caa1fc95af99802e31cb3a4b57ef7ebc5e --- lams_admin/conf/language/lams/ApplicationResources_en_AU.properties (.../ApplicationResources_en_AU.properties) (revision 62aaf160878735888d077bf28fac3c1989bb8fbd) +++ lams_admin/conf/language/lams/ApplicationResources_en_AU.properties (.../ApplicationResources_en_AU.properties) (revision 139e91caa1fc95af99802e31cb3a4b57ef7ebc5e) @@ -635,6 +635,7 @@ sysadmin.lesson.allow.restart =Learners can restart the lesson sysadmin.lesson.default =Lesson default settings config.enable.portrait.editing =Enable profile portrait editing +config.enable.forgot.your.password.link =Enable "Forgot your password" link at the login page #======= End labels: Exported 629 labels for en AU ===== Index: lams_build/build.xml =================================================================== diff -u -r313e0d1b68134b9b7bb9490628a4c1a90f77287c -r139e91caa1fc95af99802e31cb3a4b57ef7ebc5e --- lams_build/build.xml (.../build.xml) (revision 313e0d1b68134b9b7bb9490628a4c1a90f77287c) +++ lams_build/build.xml (.../build.xml) (revision 139e91caa1fc95af99802e31cb3a4b57ef7ebc5e) @@ -154,6 +154,7 @@ + Index: lams_central/conf/language/lams/ApplicationResources_en_AU.properties =================================================================== diff -u -rc97471649fc30fae9217a1d2a43d10ce1bbac117 -r139e91caa1fc95af99802e31cb3a4b57ef7ebc5e --- lams_central/conf/language/lams/ApplicationResources_en_AU.properties (.../ApplicationResources_en_AU.properties) (revision c97471649fc30fae9217a1d2a43d10ce1bbac117) +++ lams_central/conf/language/lams/ApplicationResources_en_AU.properties (.../ApplicationResources_en_AU.properties) (revision 139e91caa1fc95af99802e31cb3a4b57ef7ebc5e) @@ -180,7 +180,9 @@ forgot.password.email.subject =LAMS server - Forgot password response forgot.password.email.body =Click the link below and it will take you to a page where you can change your password. forgot.password.email.sent =An email has been sent to your email address. -error.user.not.found =Unable to find the username in LAMS. Please check your username and try again. +forgot.password.request.processed =If the email/username that you have provided exists, an email would be sent to the registered email address. + + error.support.email.not.set =Email could not be sent. The LAMS server has not been configured to handle emails. Please contact your system administrator. error.password.request.expired =This request for a new password has expired. Please click the "Forgot your Password" link again to make a new request. label.forgot.password.instructions.1 =Please enter your user name or email below. An email will be sent to you shortly with a link that will allow you to change your password. You only need to enter one value. @@ -189,7 +191,6 @@ label.forgot.password.username =By username error.forgot.password.fields =Both fields are required. Please try again. error.email.not.sent =Server failed to send email to recipient. Please contact your system administrator. -error.email.not.found =Unable to find a user that matches the given email. Please check your email address and try again. error.forgot.password.email =Please enter an email address. error.forgot.password.username =Please enter a username. button.select.another.importfile =Select another file to import Index: lams_central/src/java/org/lamsfoundation/lams/web/ForgotPasswordServlet.java =================================================================== diff -u -r09e8dda85a2c2162a646d86fd69a8037643553fd -r139e91caa1fc95af99802e31cb3a4b57ef7ebc5e --- lams_central/src/java/org/lamsfoundation/lams/web/ForgotPasswordServlet.java (.../ForgotPasswordServlet.java) (revision 09e8dda85a2c2162a646d86fd69a8037643553fd) +++ lams_central/src/java/org/lamsfoundation/lams/web/ForgotPasswordServlet.java (.../ForgotPasswordServlet.java) (revision 139e91caa1fc95af99802e31cb3a4b57ef7ebc5e) @@ -13,6 +13,7 @@ import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; +import org.apache.commons.lang.StringUtils; import org.apache.log4j.Logger; import org.hibernate.HibernateException; import org.hibernate.id.Configurable; @@ -23,6 +24,7 @@ import org.lamsfoundation.lams.usermanagement.User; import org.lamsfoundation.lams.usermanagement.service.IUserManagementService; import org.lamsfoundation.lams.util.Configuration; +import org.lamsfoundation.lams.util.ConfigurationKeys; import org.lamsfoundation.lams.util.Emailer; import org.lamsfoundation.lams.util.FileUtilException; import org.lamsfoundation.lams.util.MessageService; @@ -40,29 +42,25 @@ public class ForgotPasswordServlet extends HttpServlet { private static final long serialVersionUID = -4833236166181290760L; private static Logger log = Logger.getLogger(ForgotPasswordServlet.class); - + @Autowired protected MessageService centralMessageService; @Autowired protected IUserManagementService userManagementService; // states - public static String SMTP_SERVER_NOT_SET = "error.support.email.not.set"; - public static String USER_NOT_FOUND = "error.user.not.found"; - public static String PASSWORD_REQUEST_EXPIRED = "error.password.request.expired"; - public static String SUCCESS_REQUEST_EMAIL = "forgot.password.email.sent"; - public static String SUCCESS_CHANGE_PASS = "heading.password.changed.screen"; - public static String EMAIL_NOT_FOUND = "error.email.not.found"; - public static String INTERNAL_ERROR = "error.email.internal"; - public static String EMAIL_FAILED = "error.email.not.sent"; - public static String REQUEST_KEY_NOT_FOUND = "error.forgot.password.incorrect.key"; + private static String SMTP_SERVER_NOT_SET = "error.support.email.not.set"; + private static String PASSWORD_REQUEST_EXPIRED = "error.password.request.expired"; + private static String REQUEST_PROCESSED = "forgot.password.request.processed"; + private static String SUCCESS_CHANGE_PASS = "heading.password.changed.screen"; + private static String INTERNAL_ERROR = "error.email.internal"; + private static String EMAIL_FAILED = "error.email.not.sent"; + private static String REQUEST_KEY_NOT_FOUND = "error.forgot.password.incorrect.key"; private static int MILLISECONDS_IN_A_DAY = 86400000; - private static String STATE = "&state="; private static String LANGUAGE_KEY = "&languageKey="; - private static String EMAIL_SENT = "&emailSent="; - + /* * Request Spring to lookup the applicationContext tied to the current ServletContext and inject service beans * available in that applicationContext. @@ -77,7 +75,15 @@ public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { String method = request.getParameter("method"); - if (method.equals("requestEmail")) { + if (method.equals("showForgotYourPasswordPage")) { + if (Configuration.getAsBoolean(ConfigurationKeys.FORGOT_YOUR_PASSWORD_LINK_ENABLE)) { + request.getRequestDispatcher("/forgotPassword.jsp").forward(request, response); + } else { + //if people try to get to the forgot your password page by going to the URL directly, we display a 404 error message + response.sendError(HttpServletResponse.SC_NOT_FOUND); + } + + } else if (method.equals("requestEmail")) { String selectType = request.getParameter("selectType"); Boolean findByEmail = false; String param = ""; @@ -87,16 +93,16 @@ } else { param = request.getParameter("login"); } - handleEmailRequest(findByEmail, param.trim(), response); + } else if (method.equals("requestPasswordChange")) { String newPassword = request.getParameter("newPassword"); String key = request.getParameter("key"); handlePasswordChange(newPassword, key, response); + } else { response.sendError(HttpServletResponse.SC_BAD_REQUEST); } - } /** @@ -113,12 +119,6 @@ */ public void handleEmailRequest(Boolean findByEmail, String param, HttpServletResponse response) throws ServletException, IOException { - - int success = 0; - String languageKey = ""; - - boolean err = false; - if ((param == null) || param.equals("")) { response.sendError(HttpServletResponse.SC_BAD_REQUEST); return; @@ -128,47 +128,48 @@ String supportEmail = Configuration.get("LamsSupportEmail"); User user = null; - if ((SMPTServer == null) || SMPTServer.equals("") || (supportEmail == null) || supportEmail.equals("")) { + String languageKey = null; + boolean skipSendingEmail = false; + if (StringUtils.isBlank(SMPTServer) || StringUtils.isBlank(supportEmail)) { // Validate SMTP not set up languageKey = ForgotPasswordServlet.SMTP_SERVER_NOT_SET; - + } else { // get the user by email or login if (!findByEmail) { if (userManagementService.getUserByLogin(param) != null) { user = userManagementService.getUserByLogin(param); + } else { // validate user is not found - languageKey = ForgotPasswordServlet.USER_NOT_FOUND; - err = true; + skipSendingEmail = true; } - + } else { try { List users = userManagementService.getAllUsersWithEmail(param); if (users.size() == 1) { user = users.get(0); - + } else if (users.size() == 0) { // validate no user with email found - languageKey = ForgotPasswordServlet.EMAIL_NOT_FOUND; - err = true; - + skipSendingEmail = true; + } else { // validate multiple users with email found languageKey = ForgotPasswordServlet.INTERNAL_ERROR; - ForgotPasswordServlet.log - .info("Password recovery: The email is assigned to multiple users: " + param); - err = true; + log.info("Password recovery: The email is assigned to multiple users: " + param); + skipSendingEmail = true; + } } catch (Exception e) { languageKey = ForgotPasswordServlet.INTERNAL_ERROR; - ForgotPasswordServlet.log.error("Error while recovering password.", e); - err = true; + log.error("Error while recovering password.", e); + skipSendingEmail = true; } } - if (!err) { + if (!skipSendingEmail) { boolean isHtmlFormat = false; // generate a key for the request String key = ForgotPasswordServlet.generateUniqueKey(); @@ -188,43 +189,31 @@ try { Emailer.sendFromSupportEmail(centralMessageService.getMessage("forgot.password.email.subject"), user.getEmail(), body, isHtmlFormat); - languageKey = ForgotPasswordServlet.SUCCESS_REQUEST_EMAIL; - success = 1; } catch (AddressException e) { // failure handling - ForgotPasswordServlet.log.error( - "Problem sending email to: " + user.getLogin() + " with email: " + user.getEmail(), e); - // response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR); + log.error("Problem sending email to: " + user.getLogin() + " with email: " + user.getEmail(), e); languageKey = ForgotPasswordServlet.EMAIL_FAILED; - success = 0; } catch (MessagingException e) { // failure handling - ForgotPasswordServlet.log.error( - "Problem sending email to: " + user.getLogin() + " with email: " + user.getEmail(), e); - // response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR); + log.error("Problem sending email to: " + user.getLogin() + " with email: " + user.getEmail(), e); languageKey = ForgotPasswordServlet.EMAIL_FAILED; - success = 0; } catch (Exception e) { // failure handling - ForgotPasswordServlet.log.error( - "Problem sending email to: " + user.getLogin() + " with email: " + user.getEmail(), e); + log.error("Problem sending email to: " + user.getLogin() + " with email: " + user.getEmail(), e); languageKey = ForgotPasswordServlet.EMAIL_FAILED; - success = 0; - // response.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR); } - } - } - String redirectStr = Configuration.get("ServerURL") + "forgotPasswordProc.jsp?" + ForgotPasswordServlet.STATE - + success + ForgotPasswordServlet.LANGUAGE_KEY + languageKey; + //show message as an error only in case message differs from the default one + boolean showErrorMessage = languageKey != null; + //show default message if there is no error message + languageKey = languageKey == null ? ForgotPasswordServlet.REQUEST_PROCESSED : languageKey; - if ((success == 1) && (user.getEmail() != null)) { - redirectStr += ForgotPasswordServlet.EMAIL_SENT + java.net.URLEncoder.encode(user.getEmail(), "UTF-8"); - } + String redirectUrl = Configuration.get("ServerURL") + "forgotPasswordProc.jsp?" + + ForgotPasswordServlet.LANGUAGE_KEY + languageKey + "&showErrorMessage=" + showErrorMessage; - response.sendRedirect(redirectStr); + response.sendRedirect(redirectUrl); } /** @@ -236,48 +225,47 @@ public void handlePasswordChange(String newPassword, String key, HttpServletResponse response) throws ServletException, IOException { int success = 0; - String languageKey = ""; if ((key == null) || key.equals("") || (newPassword == null) || newPassword.equals("")) { response.sendError(HttpServletResponse.SC_BAD_REQUEST); return; } + String languageKey = ""; + boolean showErrorMessage = false; ForgotPasswordRequest fp = userManagementService.getForgotPasswordRequest(key); - if (fp == null) { - response.sendRedirect( - Configuration.get("ServerURL") + "forgotPasswordProc.jsp?" + ForgotPasswordServlet.STATE + 0 - + ForgotPasswordServlet.LANGUAGE_KEY + ForgotPasswordServlet.REQUEST_KEY_NOT_FOUND); - return; - } + languageKey = ForgotPasswordServlet.REQUEST_KEY_NOT_FOUND; + showErrorMessage = true; - long cutoffTime = fp.getRequestDate().getTime() + ForgotPasswordServlet.MILLISECONDS_IN_A_DAY; - Date now = new Date(); - long nowLong = now.getTime(); - - if (nowLong < cutoffTime) { - User user = (User) userManagementService.findById(User.class, fp.getUserId()); - userManagementService.updatePassword(user.getLogin(), newPassword); - userManagementService.logPasswordChanged(user, user); - languageKey = ForgotPasswordServlet.SUCCESS_CHANGE_PASS; - success = 1; } else { - // validate password request expired - languageKey = ForgotPasswordServlet.PASSWORD_REQUEST_EXPIRED; - } + long cutoffTime = fp.getRequestDate().getTime() + ForgotPasswordServlet.MILLISECONDS_IN_A_DAY; + long now = new Date().getTime(); - userManagementService.delete(fp); + if (now < cutoffTime) { + User user = (User) userManagementService.findById(User.class, fp.getUserId()); + userManagementService.updatePassword(user.getLogin(), newPassword); + userManagementService.logPasswordChanged(user, user); + languageKey = ForgotPasswordServlet.SUCCESS_CHANGE_PASS; - response.sendRedirect(Configuration.get("ServerURL") + "forgotPasswordProc.jsp?" + ForgotPasswordServlet.STATE - + success + ForgotPasswordServlet.LANGUAGE_KEY + languageKey); + } else { + // validate password request expired + languageKey = ForgotPasswordServlet.PASSWORD_REQUEST_EXPIRED; + showErrorMessage = true; + } + userManagementService.delete(fp); + } + + String redirectUrl = Configuration.get("ServerURL") + "forgotPasswordProc.jsp?" + + ForgotPasswordServlet.LANGUAGE_KEY + languageKey + "&showErrorMessage=" + showErrorMessage; + response.sendRedirect(response.encodeRedirectURL(redirectUrl)); } /** * Generates the unique key used for the forgot password request * * @return a unique key - * @throws HibernateException + * @throws HibernateException * @throws FileUtilException * @throws IOException */ Index: lams_central/web/WEB-INF/web.xml =================================================================== diff -u -r7c0aefd996982f4c4412973df9695d5c3fed8635 -r139e91caa1fc95af99802e31cb3a4b57ef7ebc5e --- lams_central/web/WEB-INF/web.xml (.../web.xml) (revision 7c0aefd996982f4c4412973df9695d5c3fed8635) +++ lams_central/web/WEB-INF/web.xml (.../web.xml) (revision 139e91caa1fc95af99802e31cb3a4b57ef7ebc5e) @@ -590,7 +590,6 @@ /services/UserRoleManager /services/xml/CourseGroupManager /ForgotPasswordRequest - /forgotPassword.jsp /forgotPasswordChange.jsp /forgotPasswordProc.jsp /loginTwoFactorAuth.jsp Index: lams_central/web/forgotPassword.jsp =================================================================== diff -u -r64a95d70dec3a8dfaa197e138815386c1c42adfd -r139e91caa1fc95af99802e31cb3a4b57ef7ebc5e --- lams_central/web/forgotPassword.jsp (.../forgotPassword.jsp) (revision 64a95d70dec3a8dfaa197e138815386c1c42adfd) +++ lams_central/web/forgotPassword.jsp (.../forgotPassword.jsp) (revision 139e91caa1fc95af99802e31cb3a4b57ef7ebc5e) @@ -70,8 +70,9 @@ if (keycode == 13) { validateForm(); return false; - } else + } else { return true; + } } @@ -105,26 +106,25 @@
- +
-

- + +
-
Index: lams_central/web/forgotPasswordChange.jsp =================================================================== diff -u -r64a95d70dec3a8dfaa197e138815386c1c42adfd -r139e91caa1fc95af99802e31cb3a4b57ef7ebc5e --- lams_central/web/forgotPasswordChange.jsp (.../forgotPasswordChange.jsp) (revision 64a95d70dec3a8dfaa197e138815386c1c42adfd) +++ lams_central/web/forgotPasswordChange.jsp (.../forgotPasswordChange.jsp) (revision 139e91caa1fc95af99802e31cb3a4b57ef7ebc5e) @@ -29,9 +29,9 @@ }; var mustHaveUppercase = ${mustHaveUppercase}, - mustHaveNumerics = ${mustHaveNumerics}, - mustHaveLowercase = ${mustHaveLowercase}, - mustHaveSymbols = ${mustHaveSymbols}; + mustHaveNumerics = ${mustHaveNumerics}, + mustHaveLowercase = ${mustHaveLowercase}, + mustHaveSymbols = ${mustHaveSymbols}; $.validator.addMethod("pwcheck", function(value) { return (!mustHaveUppercase || /[A-Z]/.test(value)) && // has uppercase letters @@ -87,7 +87,6 @@ document.changePass.submit(); } }); - }); Index: lams_central/web/forgotPasswordProc.jsp =================================================================== diff -u -r64a95d70dec3a8dfaa197e138815386c1c42adfd -r139e91caa1fc95af99802e31cb3a4b57ef7ebc5e --- lams_central/web/forgotPasswordProc.jsp (.../forgotPasswordProc.jsp) (revision 64a95d70dec3a8dfaa197e138815386c1c42adfd) +++ lams_central/web/forgotPasswordProc.jsp (.../forgotPasswordProc.jsp) (revision 139e91caa1fc95af99802e31cb3a4b57ef7ebc5e) @@ -1,32 +1,8 @@ <%@ page language="java" pageEncoding="UTF-8" contentType="text/html;charset=utf-8"%> -<%@page import="org.apache.commons.lang.StringEscapeUtils"%> -<%@page import="org.lamsfoundation.lams.web.ForgotPasswordServlet"%> -<%@page import="org.lamsfoundation.lams.util.MessageService"%> -<%@page import="org.springframework.web.context.WebApplicationContext"%> -<%@page import="org.springframework.web.context.support.WebApplicationContextUtils"%> -<%@ page import="org.lamsfoundation.lams.util.Configuration"%> -<%@ page import="org.lamsfoundation.lams.util.ConfigurationKeys"%> - <%@ taglib uri="tags-fmt" prefix="fmt"%> <%@ taglib uri="tags-lams" prefix="lams"%> <%@ taglib uri="tags-core" prefix="c"%> -<% - String languageKey = StringEscapeUtils.escapeHtml(request.getParameter("languageKey")); - String stateStr = request.getParameter("state"); - String emailStr = request.getParameter("emailSent"); -%> - - - <%=languageKey%> - - - <%=stateStr%> - - - <%=emailStr%> - - @@ -39,12 +15,7 @@ @@ -53,18 +24,19 @@ + -

- -

- - - - - + + + + + + + + - + @@ -171,10 +174,10 @@ - +