From 880db3ad3cbc69a51ceda7796c519aa4d1dda299 Mon Sep 17 00:00:00 2001
From: Damien Regad <damien.regad@merckserono.net>
Date: Tue, 16 Nov 2010 16:40:19 +0100
Subject: [PATCH] Fix #10887:  Remove "Reset Password" button on User Edit Page when using LDAP

With LDAP, Mantis is not controlling the password, so resetting it does not make
sense (i.e. be consistent with behavior in My Account page)

Also fixed potential XSS vulnerabilities due to unescaped variables in forms.
---
 manage_user_edit_page.php |   13 +++++++++----
 1 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/manage_user_edit_page.php b/manage_user_edit_page.php
index b0dd092..facf47d 100644
--- a/manage_user_edit_page.php
+++ b/manage_user_edit_page.php
@@ -177,24 +177,28 @@
 
 <!-- RESET AND DELETE -->
 <div class="border center">
+
 <!-- Reset Button -->
+<?php if( !$t_ldap ) { ?>
 	<form method="post" action="manage_user_reset.php">
 <?php echo form_security_field( 'manage_user_reset' ) ?>
-		<input type="hidden" name="user_id" value="<?php echo $t_user['id'] ?>" />
+		<input type="hidden" name="user_id" value="<?php echo string_attribute( $t_user['id'] ) ?>" />
 		<input type="submit" class="button" value="<?php echo lang_get( 'reset_password_button' ) ?>" />
 	</form>
+<?php } ?>
 
 <!-- Delete Button -->
 <?php if ( !( ( user_is_administrator( $t_user_id ) && ( user_count_level( config_get_global( 'admin_site_threshold' ) ) <= 1 ) ) ) ) { ?>
 	<form method="post" action="manage_user_delete.php">
 <?php echo form_security_field( 'manage_user_delete' ) ?>
 
-		<input type="hidden" name="user_id" value="<?php echo $t_user['id'] ?>" />
+		<input type="hidden" name="user_id" value="<?php echo string_attribute( $t_user['id'] ) ?>" />
 		<input type="submit" class="button" value="<?php echo lang_get( 'delete_user_button' ) ?>" />
 	</form>
 <?php } ?>
 </div>
 <br />
+<?php if( !$t_ldap ) { ?>
 <div align="center">
 <?php
 	if ( ( ON == config_get( 'send_reset_password' ) ) && ( ON == config_get( 'enable_email_notification' ) ) ) {
@@ -204,6 +208,7 @@
 	}
 ?>
 </div>
+<?php } ?>
 
 
 <!-- PROJECT ACCESS (if permissions allow) and user is not ADMINISTRATOR -->
@@ -232,8 +237,8 @@
 
 <form method="post" action="manage_user_proj_add.php">
 <?php echo form_security_field( 'manage_user_proj_add' ) ?>
-		<input type="hidden" name="user_id" value="<?php echo $t_user['id'] ?>" />
-<!-- Unassigend Project Selection -->
+		<input type="hidden" name="user_id" value="<?php echo string_attribute( $t_user['id'] ) ?>" />
+<!-- Unassigned Project Selection -->
 <tr <?php echo helper_alternate_class() ?> valign="top">
 	<td class="category">
 		<?php echo lang_get( 'unassigned_projects' ) ?>:
-- 
1.7.1