/**
* Checks the password hash that was retrieved from the Option table. Used as a sanity check
* when finishing the reset password process. If a password is obviously malformed, changing
* a user's password to it will keep the user from being able to login again.
*
* Derived classes can override this method to provide fewer or more checks.
*
* @param string $passwordHash The password hash to check.
* @throws Exception if the password hash length is incorrect.
*/
protected function checkPasswordHash($passwordHash)
{
$hashInfo = $this->passwordHelper->info($passwordHash);
if (!isset($hashInfo['algo']) || 0 >= $hashInfo['algo']) {
throw new Exception(Piwik::translate('Login_ExceptionPasswordMD5HashExpected'));
}
}
/**
* Updates a user in the database.
* Only login and password are required (case when we update the password).
*
* If the password changes and the user has an old token_auth (legacy MD5 format) associated,
* the token will be regenerated. This could break a user's API calls.
*
* @see addUser() for all the parameters
*/
public function updateUser($userLogin, $password = false, $email = false, $alias = false, $_isPasswordHashed = false)
{
Piwik::checkUserHasSuperUserAccessOrIsTheUser($userLogin);
$this->checkUserIsNotAnonymous($userLogin);
$this->checkUserExists($userLogin);
$userInfo = $this->model->getUser($userLogin);
$token_auth = $userInfo['token_auth'];
$passwordHasBeenUpdated = false;
if (empty($password)) {
$password = $userInfo['password'];
} else {
$password = Common::unsanitizeInputValue($password);
if (!$_isPasswordHashed) {
UsersManager::checkPassword($password);
$password = UsersManager::getPasswordHash($password);
}
$passwordInfo = $this->password->info($password);
if (!isset($passwordInfo['algo']) || 0 >= $passwordInfo['algo']) {
// password may have already been fully hashed
$password = $this->password->hash($password);
}
$passwordHasBeenUpdated = true;
}
if (empty($alias)) {
$alias = $userInfo['alias'];
}
if (empty($email)) {
$email = $userInfo['email'];
}
if ($email != $userInfo['email']) {
$this->checkEmail($email);
}
$alias = $this->getCleanAlias($alias, $userLogin);
$this->model->updateUser($userLogin, $password, $email, $alias, $token_auth);
Cache::deleteTrackerCache();
/**
* Triggered after an existing user has been updated.
* Event notify about password change.
*
* @param string $userLogin The user's login handle.
* @param boolean $passwordHasBeenUpdated Flag containing information about password change.
*/
Piwik::postEvent('UsersManager.updateUser.end', array($userLogin, $passwordHasBeenUpdated, $email, $password, $alias));
}
