When no password routes are available, the reset password link is still shown on special page UserLogin.
Version
MediaWiki 1.27.1
Reproduce:
Add the following line to LocalSettings.php.
$wgPasswordResetRoutes = array( 'username' => false, 'email' => false );
Problem:
In LoginSignupSpecialPage.php, the return value of PasswordReset.isAllowed() is checked as a boolean, where as it is in fact a StatusValue object, so it is always true. 'isGood()' should be called on the object instead.
Fix:
In LoginSignupSpecialPage.php, apply this patch:
@@ -656,7 +656,7 @@ abstract class LoginSignupSpecialPage extends AuthManagerSpecialPage {
if ( !$this->isSignup() && $this->showExtraInformation() ) {
$passwordReset = new PasswordReset( $this->getConfig(), AuthManager::singleton() );
- if ( $passwordReset->isAllowed( $this->getUser() ) ) {
+ if ( $passwordReset->isAllowed( $this->getUser() )->isGood() ) {
$form->addFooterText( Html::rawElement(
'div',
[ 'class' => 'mw-ui-vform-field mw-form-related-link-container' ],