diff --git a/htdocs/user/passwordforgotten.php b/htdocs/user/passwordforgotten.php index 30c5da0b2af..658c45a3753 100644 --- a/htdocs/user/passwordforgotten.php +++ b/htdocs/user/passwordforgotten.php @@ -128,41 +128,34 @@ if (empty($reshook)) { $result = $edituser->fetch('', '', '', 1, -1, $username); } + // Set the message to show (must be the same if login/email exists or not + // to avoid to guess them. + $messagewarning = '
'; + if (!$isanemail) { + $messagewarning .= $langs->trans("IfLoginExistPasswordRequestSent"); + } else { + $messagewarning .= $langs->trans("IfEmailExistPasswordRequestSent"); + } + $messagewarning .= '
'; + if ($result <= 0 && $edituser->error == 'USERNOTFOUND') { - $message = '
'; - if (!$isanemail) { - $message .= $langs->trans("IfLoginExistPasswordRequestSent"); - } else { - $message .= $langs->trans("IfEmailExistPasswordRequestSent"); - } - $message .= '
'; + $message .= $messagewarning; $username = ''; } else { - if (!$edituser->email) { - //$message = '
'.$langs->trans("ErrorLoginHasNoEmail").'
'; - if (!$isanemail) { - $message .= $langs->trans("IfLoginExistPasswordRequestSent"); - } else { - $message .= $langs->trans("IfEmailExistPasswordRequestSent"); - } + if (empty($edituser->email)) { + $message .= $messagewarning; } else { $newpassword = $edituser->setPassword($user, '', 1); if ($newpassword < 0) { - // Failed + // Technical failure $message = '
'.$langs->trans("ErrorFailedToChangePassword").'
'; } else { // Success if ($edituser->send_password($user, $newpassword, 1) > 0) { - $message = '
'; - if (!$isanemail) { - $message .= $langs->trans("IfLoginExistPasswordRequestSent"); - } else { - $message .= $langs->trans("IfEmailExistPasswordRequestSent"); - } - //$message .= $langs->trans("PasswordChangeRequestSent", $edituser->login, dolObfuscateEmail($edituser->email)); - $message .= '
'; + $message .= $messagewarning; $username = ''; } else { + // Technical failure $message .= '
'.$edituser->error.'
'; } }