diff --git a/wp-admin/wp-admin.css b/wp-admin/wp-admin.css index 9727eae313..18d849467b 100644 --- a/wp-admin/wp-admin.css +++ b/wp-admin/wp-admin.css @@ -205,7 +205,7 @@ textarea, input, select { border-top-color: #999; } -.submit, #quicktags, .editform th, #postcustomsubmit, #login form { +.submit, #quicktags, .editform th, #postcustomsubmit { text-align: right; } diff --git a/wp-login.php b/wp-login.php index a521089b09..92176da910 100644 --- a/wp-login.php +++ b/wp-login.php @@ -47,6 +47,11 @@ case 'lostpassword': } window.onload = focusit; +
@@ -60,11 +65,20 @@ if ($error)

-
-
+

+


-

+

+
@@ -72,7 +86,6 @@ if ($error) break; case 'retrievepassword': - $user_data = get_userdatabylogin($_POST['user_login']); // redefining user_login ensures we return the right case in the email $user_login = $user_data->user_login; @@ -82,14 +95,15 @@ case 'retrievepassword': die(sprintf(__('Sorry, that user does not seem to exist in our database. Perhaps you have the wrong username or e-mail address? Try again.'), 'wp-login.php?action=lostpassword')); // Generate something random for a password... md5'ing current time with a rand salt - $user_pass = substr(md5(uniqid(microtime())), 0, 6); + $key = substr( md5( uniqid( microtime() ) ), 0, 50); // now insert the new pass md5'd into the db - $wpdb->query("UPDATE $wpdb->users SET user_pass = MD5('$user_pass') WHERE user_login = '$user_login'"); - $message = __('Login') . ": $user_login\r\n"; - $message .= __('Password') . ": $user_pass\r\n"; - $message .= get_settings('siteurl') . '/wp-login.php'; - - $m = wp_mail($user_email, sprintf(__("[%s] Your login and password"), get_settings('blogname')), $message); + $wpdb->query("UPDATE $wpdb->users SET user_activation_key = '$key' WHERE user_login = '$user_login'"); + $message .= __("Someone has asked to reset a password for the login this site\n\n " . get_option('siteurl') ) . "\n\n"; + $message .= __('Login') . ": $user_login\r\n\r\n"; + $message .= __("To reset your password visit the following address, otherwise just ignore this email and nothing will happen.\n\n"); + $message .= get_settings('siteurl') . "/wp-login.php?action=resetpass&key=$key"; +mail($user_email, sprintf(__("[%s] Password Reset"), get_settings('blogname')), $message); + $m = wp_mail($user_email, sprintf(__("[%s] Password Reset"), get_settings('blogname')), $message); if ($m == false) { echo '

' . __('The e-mail could not be sent.') . "
\n"; @@ -97,14 +111,42 @@ case 'retrievepassword': die(); } else { echo '

' . sprintf(__("The e-mail was sent successfully to %s's e-mail address."), $user_login) . '
'; - echo "" . __('Click here to login!') . '

'; - // send a copy of password change notification to the admin - wp_mail(get_settings('admin_email'), sprintf(__('[%s] Password Lost/Change'), get_settings('blogname')), sprintf(__('Password Lost and Changed for user: %s'), $user_login)); + echo "" . __('Click here to login!') . '

'; die(); } break; +case 'resetpass' : + + // Generate something random for a password... md5'ing current time with a rand salt + $key = $_GET['key']; + $user = $wpdb->get_row("SELECT * FROM $wpdb->users WHERE user_activation_key = '$key'"); + if ( !$user ) + die( __('Sorry, that key does not appear to be valid.') ); + + $new_pass = md5( substr( md5( uniqid( microtime() ) ), 0, 7) ); + $wpdb->query("UPDATE $wpdb->users SET user_pass = '$new_pass', user_activation_key = '' WHERE user_login = '$user->user_login'"); + $message = __('Login') . ": $user_login\r\n"; + $message .= __('Password') . ": $new_pass\r\n"; + $message .= get_settings('siteurl') . '/wp-login.php'; + + $m = wp_mail($user->user_email, sprintf(__("[%s] Your new password"), get_settings('blogname')), $message); + + if ($m == false) { + echo '

' . __('The e-mail could not be sent.') . "
\n"; + echo __('Possible reason: your host may have disabled the mail() function...') . "

"; + die(); + } else { + echo '

' . sprintf(__("Your new password is in the mail."), $user_login) . '
'; + echo "" . __('Click here to login!') . '

'; + die(); + } + + // send a copy of password change notification to the admin + wp_mail(get_settings('admin_email'), sprintf(__('[%s] Password Lost/Change'), get_settings('blogname')), sprintf(__('Password Lost and Changed for user: %s'), $user_login)); +break; + case 'login' : default: @@ -158,6 +200,11 @@ default: } window.onload = focusit; + @@ -169,10 +216,10 @@ if ( $error ) ?>
-

-

+

+

- +

diff --git a/wp-register.php b/wp-register.php index c455776507..c12b3b06b2 100644 --- a/wp-register.php +++ b/wp-register.php @@ -26,8 +26,6 @@ switch($action) { case 'register': $user_login = $_POST['user_login']; - $pass1 = $_POST['pass1']; - $pass2 = $_POST['pass2']; $user_email = $_POST['user_email']; /* checking login has been typed */ @@ -35,17 +33,6 @@ case 'register': die (__('ERROR: Please enter a login.')); } - /* checking the password has been typed twice */ - if ($pass1 == '' || $pass2 == '') { - die (__('ERROR: Please enter your password twice.')); - } - - /* checking the password has been typed twice the same */ - if ($pass1 != $pass2) { - die (__('ERROR: Please type the same password in the two password fields.')); - } - $user_nickname = $user_login; - /* checking e-mail address */ if ($user_email == '') { die (__('ERROR: Please type your e-mail address.')); @@ -63,17 +50,17 @@ case 'register': $user_browser = $wpdb->escape($_SERVER['HTTP_USER_AGENT']); - $user_login = $wpdb->escape($user_login); - $pass1 = $wpdb->escape($pass1); - $user_nickname = $wpdb->escape($user_nickname); - $user_nicename = sanitize_title($user_nickname); + $user_login = $wpdb->escape( preg_replace('|a-z0-9 _.-|i', '', $user_login) ); + $user_nickname = $user_login; + $user_nicename = sanitize_title($user_nickname); $now = gmdate('Y-m-d H:i:s'); if (get_settings('new_users_can_blog') >= 1) $user_level = 1; + $password = substr( md5( uniqid( microtime() ) ), 0, 7); $result = $wpdb->query("INSERT INTO $wpdb->users (user_login, user_pass, user_nickname, user_email, user_ip, user_browser, user_registered, user_level, user_idmode, user_nicename) VALUES - ('$user_login', MD5('$pass1'), '$user_nickname', '$user_email', '$user_ip', '$user_browser', '$now', '$user_level', 'nickname', '$user_nicename')"); + ('$user_login', MD5('$password'), '$user_nickname', '$user_email', '$user_ip', '$user_browser', '$now', '$user_level', 'nickname', '$user_nicename')"); if ($result == false) { die (sprintf(__('ERROR: Couldn’t register you... please contact the webmaster !'), get_settings('admin_email'))); @@ -83,6 +70,12 @@ case 'register': for ($i = 0; $i < strlen($pass1); $i = $i + 1) { $stars .= '*'; } + + $message = __('Login') . ": $user_login\r\n"; + $message .= __('Password') . ": $new_pass\r\n"; + $message .= get_settings('siteurl') . '/wp-login.php'; + + wp_mail($user_email, sprintf(__("[%s] Your login information"), get_settings('blogname')), $message); $message = sprintf(__("New user registration on your blog %1\$s:\n\nLogin: %2\$s \n\nE-mail: %3\$s"), get_settings('blogname'), $user_login, $user_email); @@ -101,7 +94,7 @@ case 'register':


-
+ emailed to you

@@ -149,21 +142,30 @@ default: WordPress » <?php _e('Registration Form') ?> +
-

+

WordPress

+

- - -
-
- -
- :
- + +

+

+

:

+

A password will be emailed to you.

+

+