| Additional Information | I've done the following:
account_page.php
// after the line 95 [<form method="post" action="account_update.php">]
if ( $t_force_pw_reset ) { //I use it as a flag "it's the first registration instance of account_update.php
echo("<HR/>");
include ( dirname( FILE ) . DIRECTORY_SEPARATOR . 'terms_and_conditions.php.inc' ); // I store the "terms..." text here
echo("<HR/> I agree with this terms and conditions blablabla I'm too stupid to know how to use lang files and lang_get() properly <input name=\"agree\" type=\"checkbox\"/> <HR/>");
}
account_update.php
// after the line 47 [$t_user_id = auth_get_current_user_id();]
$f_terms = gpc_get_string( 'agree', '' ); // if we came here through verify.php -> account_page.php -> account_update.php
if( !$f_terms ){
echo("<P>You can use this Mantis only if you accept the conditions blablabla I've already said I don't know how to use lang files.</P>");
echo("<P>You have your password reset. The corresponding letter was sent to your address. You can try again confirming registration by the link from this email letter.</P>");
user_reset_password( $t_user_id, true );
form_security_purge('account_update');
auth_logout();
die;
}
- User receives the letter about his registration, or the letter after "lost password" feature, etc. He goes by the link from the letter.
- He opens account page beginning with the password change demand and the "Terms and conditions" text and the checkbox following.
3.1 He sets the checkbox checked and goes further as it used to be.
3.2 Or he leaves the checkbox unchecked. We output some kind of "sorry, bye" message, reset his password, and then he may try to do it again with a new letter.
This solution lacks necessary checks, e.g.:
if( OFF == config_get( 'lost_password_feature' ) ||
OFF == config_get( 'send_reset_password' ) ||
OFF == config_get( 'enable_email_notification' ) ) {
trigger_error( ERROR_LOST_PASSWORD_NOT_ENABLED, ERROR );
}
// ...
if( user_is_protected( $t_user_id ) ) {
trigger_error( ERROR_PROTECTED_ACCOUNT, ERROR );
}
if( !user_is_lost_password_request_allowed( $t_user_id ) ) {
trigger_error( ERROR_LOST_PASSWORD_MAX_IN_PROGRESS_ATTEMPTS_REACHED, ERROR );
}
// ...
And has some weaknesses such as unnecessary filling fields on the account_page.php etc.
It also has to be included to the config file as an option - to show terms and to disable it.
But that's the general idea I suggest. |
|---|
