Add RFC docs for the phpBB core events login/password-reset protection would need

docs/events/login_body_buttons_before.txt

@@ -0,0 +1,59 @@
+TITLE
+=====
+[RFC] New template event login_body_buttons_before
+
+BODY
+====
+login_body.html has no <!-- EVENT --> tags anywhere in it. The PHP side
+of the login form already has a usable hook: core.login_box_before
+fires at the very start of login_box() in includes/functions.php,
+before credentials are checked, and exposes a settable $err string
+that aborts the login attempt when non-empty. What's missing is a
+place in the template to actually render a widget into the form, so
+an extension can only reject a bad submission server-side, never show
+anything to the user client-side.
+
+Concretely: mosparo/phpbbintegration (a CAPTCHA-alternative extension)
+already protects the registration and posting forms, both of which do
+have template events to render its widget into. The login form is the
+one place login_box_before exists but the widget has nowhere to go.
+
+This is the same gap and the same proposed name as an identical request
+from a separate honeypot-style anti-spam extension, so this should be
+treated as one shared request rather than two competing ones if it's
+ever filed against phpBB.
+
+PROPOSED EVENT (template)
+--------------------------
+Name: login_body_buttons_before
+File: styles/prosilver/template/login_body.html
+Location: immediately after the form token, immediately before the
+submit-button block.
+
+Current markup at that point:
+
+	{S_LOGIN_REDIRECT}
+	{S_FORM_TOKEN_LOGIN}
+	<dl>
+		<dt>&nbsp;</dt>
+		<dd>{S_HIDDEN_FIELDS}<input type="submit" name="login" tabindex="6" value="{L_LOGIN}" class="button1" /></dd>
+	</dl>
+
+Proposed insertion:
+
+	{S_LOGIN_REDIRECT}
+	{S_FORM_TOKEN_LOGIN}
+	<!-- EVENT login_body_buttons_before -->
+	<dl>
+		<dt>&nbsp;</dt>
+		<dd>{S_HIDDEN_FIELDS}<input type="submit" name="login" tabindex="6" value="{L_LOGIN}" class="button1" /></dd>
+	</dl>
+
+TESTING
+-------
+Manually verified against the phpBB 3.3.17 branch (checked
+styles/prosilver/template/login_body.html and the login_box_before
+trigger_event() call in includes/functions.php directly) that no
+<!-- EVENT --> tag exists anywhere in the login template, and that
+core.login_box_before already exposes a settable $err before the
+credential check runs.

docs/events/ucp_remind_request_before.txt

@@ -0,0 +1,87 @@
+TITLE
+=====
+[RFC] New PHP event core.ucp_remind_request_before
+
+BODY
+====
+phpbb\ucp\controller\reset_password::request() (the "forgot password,
+enter your email" step) only has core.ucp_remind_modify_select_sql,
+which lets an extension tweak the SQL query used to look up the user.
+It has no variable an extension can use to reject the submission
+outright, and no place before the form-key check to hook in.
+
+Concretely: mosparo/phpbbintegration already protects registration and
+posting the same way, an event fires, the extension checks a submitted
+token against the mosparo API, and on failure it rejects the request
+before any further processing happens. This method has nowhere to do
+that.
+
+This request pairs with docs/events/ucp_reset_password_verify_before.txt
+(the second step of the same flow) and
+docs/events/ucp_reset_password_widget_before.txt (the shared template
+event both steps render through).
+
+PROPOSED EVENT (PHP)
+---------------------
+Name: core.ucp_remind_request_before
+File: phpbb/ucp/controller/reset_password.php, function request()
+Location: immediately after the form-key check, before the existing
+empty($email) check. Every other failure case in this method already
+returns via $this->helper->message('LANG_KEY'), so a settable $error
+language key fits the method's existing convention exactly, no new
+error-display mechanism needed.
+
+Current markup at that point:
+
+	if ($submit)
+	{
+		if (!check_form_key('ucp_reset_password'))
+		{
+			throw new http_exception(Response::HTTP_UNAUTHORIZED, 'FORM_INVALID');
+		}
+
+		if (empty($email))
+		{
+			return $this->helper->message('NO_EMAIL_USER');
+		}
+
+Proposed insertion:
+
+	if ($submit)
+	{
+		if (!check_form_key('ucp_reset_password'))
+		{
+			throw new http_exception(Response::HTTP_UNAUTHORIZED, 'FORM_INVALID');
+		}
+
+		$error = '';
+
+		/**
+		* Verify a password reset request before it is processed
+		*
+		* @event core.ucp_remind_request_before
+		* @var string	email		User's email from the form
+		* @var string	username	User's username from the form
+		* @var string	error		Language key to abort with, empty string if the request is valid
+		* @since to be filled in by the phpBB dev team at merge time
+		*/
+		$vars = array('email', 'username', 'error');
+		extract($this->dispatcher->trigger_event('core.ucp_remind_request_before', compact($vars)));
+
+		if ($error)
+		{
+			return $this->helper->message($error);
+		}
+
+		if (empty($email))
+		{
+			return $this->helper->message('NO_EMAIL_USER');
+		}
+
+TESTING
+-------
+Manually verified against the phpBB 3.3.17 branch (checked
+phpbb/ucp/controller/reset_password.php directly) that
+core.ucp_remind_modify_select_sql is a SQL-array-only hook with no
+error/rejection variable, and that request() has no other event before
+the SQL query is built.

docs/events/ucp_reset_password_verify_before.txt

@@ -0,0 +1,72 @@
+TITLE
+=====
+[RFC] New PHP event core.ucp_reset_password_verify_before
+
+BODY
+====
+phpbb\ucp\controller\reset_password::reset() (the "enter your new
+password" step, reached from the emailed link) only has
+core.ucp_reset_password_modify_select_sql, which lets an extension
+tweak the SQL query used to look up the token. It has no variable an
+extension can use to reject the submission.
+
+Unlike the request() step, this method already builds an $errors array
+(from validate_data() on the new password fields) that the template
+renders via PASSWORD_RESET_ERRORS. A new event that can append to that
+same $errors array needs no template change and no new error-display
+mechanism, it plugs directly into the existing gate.
+
+This request pairs with docs/events/ucp_remind_request_before.txt (the
+first step of the same flow) and
+docs/events/ucp_reset_password_widget_before.txt (the shared template
+event both steps render through).
+
+PROPOSED EVENT (PHP)
+---------------------
+Name: core.ucp_reset_password_verify_before
+File: phpbb/ucp/controller/reset_password.php, function reset()
+Location: immediately after the new_password/password_confirm
+validation, immediately before the existing "if (empty($errors))" gate
+that saves the new password.
+
+Current markup at that point:
+
+	$errors = array_merge($errors, validate_data($data, $check_data));
+	if (strcmp($data['new_password'], $data['password_confirm']) !== 0)
+	{
+		$errors[] = $data['password_confirm'] ? 'NEW_PASSWORD_ERROR' : 'NEW_PASSWORD_CONFIRM_EMPTY';
+	}
+	if (empty($errors))
+	{
+
+Proposed insertion:
+
+	$errors = array_merge($errors, validate_data($data, $check_data));
+	if (strcmp($data['new_password'], $data['password_confirm']) !== 0)
+	{
+		$errors[] = $data['password_confirm'] ? 'NEW_PASSWORD_ERROR' : 'NEW_PASSWORD_CONFIRM_EMPTY';
+	}
+
+	/**
+	* Verify a password reset submission before the new password is saved
+	*
+	* @event core.ucp_reset_password_verify_before
+	* @var array	user_row	The user row the password is being reset for
+	* @var array	data		Submitted new_password/password_confirm
+	* @var array	errors		Array of language keys, append to reject the submission
+	* @since to be filled in by the phpBB dev team at merge time
+	*/
+	$vars = array('user_row', 'data', 'errors');
+	extract($this->dispatcher->trigger_event('core.ucp_reset_password_verify_before', compact($vars)));
+
+	if (empty($errors))
+	{
+
+TESTING
+-------
+Manually verified against the phpBB 3.3.17 branch (checked
+phpbb/ucp/controller/reset_password.php directly) that
+core.ucp_reset_password_modify_select_sql is a SQL-array-only hook with
+no error/rejection variable, and that reset() already has a working
+$errors array and PASSWORD_RESET_ERRORS template output this event can
+plug into without any template change.

docs/events/ucp_reset_password_widget_before.txt

@@ -0,0 +1,54 @@
+TITLE
+=====
+[RFC] New template event ucp_reset_password_widget_before
+
+BODY
+====
+ucp_reset_password.html has no {% EVENT %} tags anywhere in it. Both
+steps of the password-reset flow (the "enter your email" request step
+and the "enter your new password" reset step) render through this one
+file, toggled by the S_IS_PASSWORD_RESET conditional, so a single event
+placed outside that conditional and before the shared submit button
+covers both steps at once, no need for two separate template events.
+
+Concretely: mosparo/phpbbintegration already renders its widget into
+the registration and posting forms through template events. This file
+has nowhere for it to go on either step of password reset.
+
+This request pairs with docs/events/ucp_remind_request_before.txt and
+docs/events/ucp_reset_password_verify_before.txt, the PHP-side
+verification events for the request and reset steps respectively.
+
+PROPOSED EVENT (template)
+--------------------------
+Name: ucp_reset_password_widget_before
+File: styles/prosilver/template/ucp_reset_password.html
+Location: immediately after the closing {% endif %} of the
+S_IS_PASSWORD_RESET conditional, immediately before the shared
+submit-button block.
+
+Current markup at that point:
+
+		{% endif %}
+		<dl>
+			<dt>&nbsp;</dt>
+			<dd>{{ S_HIDDEN_FIELDS }}<input type="submit" name="submit" id="submit" class="button1" value="{{ lang('SUBMIT') }}" tabindex="2" /></dd>
+		</dl>
+
+Proposed insertion:
+
+		{% endif %}
+		{% EVENT ucp_reset_password_widget_before %}
+		<dl>
+			<dt>&nbsp;</dt>
+			<dd>{{ S_HIDDEN_FIELDS }}<input type="submit" name="submit" id="submit" class="button1" value="{{ lang('SUBMIT') }}" tabindex="2" /></dd>
+		</dl>
+
+TESTING
+-------
+Manually verified against the phpBB 3.3.17 branch (checked
+styles/prosilver/template/ucp_reset_password.html and
+phpbb/ucp/controller/reset_password.php directly) that both request()
+and reset() render this same template file, that no {% EVENT %} tag
+exists anywhere in it, and that ucp_resend.html (a separate template)
+is the resend-activation-email flow, unrelated to password reset.