No OneTemporary
Actions

Size

165 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/conf/default.conf.php b/conf/default.conf.php
	index d061e79a5e..0ae150cef1 100644
	--- a/conf/default.conf.php
	+++ b/conf/default.conf.php
	@@ -1,1189 +1,1180 @@
	<?php

	// IMPORTANT: DO NOT EDIT THIS FILE.
	// This file is no longer read by default, and your efforts will have no effect.
	// Follow the instructions in the documentation to configure Phabricator.

	return array(

	// The root URI which Phabricator is installed on.
	// Example: "http://phabricator.example.com/"
	'phabricator.base-uri' => null,

	// If you have multiple environments, provide the production environment URI
	// here so that emails, etc., generated in development/sandbox environments
	// contain the right links.
	'phabricator.production-uri' => null,

	// -- IMPORTANT! Security! -------------------------------------------------- //

	// IMPORTANT: By default, Phabricator serves files from the same domain the
	// application lives on. This is convenient but not secure: it creates a large
	// class of vulnerabilities which can not be generally mitigated.
	//
	// To avoid this, you should configure a second domain in the same way you
	// have the primary domain configured (e.g., point it at the same machine and
	// set up the same vhost rules) and provide it here. For instance, if your
	// primary install is on "http://www.phabricator-example.com/", you could
	// configure "http://www.phabricator-files.com/" and specify the entire
	// domain (with protocol) here. This will enforce that files are
	// served only from the alternate domain. Ideally, you should use a
	// completely separate domain name rather than just a different subdomain.
	//
	// It is STRONGLY RECOMMENDED that you configure this. Your install is NOT
	// SECURE unless you do so.
	'security.alternate-file-domain' => null,

	// Default key for HMAC digests where the key is not important (i.e., the
	// hash itself is secret). You can change this if you want (to any other
	// string), but doing so will break existing sessions and CSRF tokens.
	'security.hmac-key' => '[D\t~Y7eNmnQGJ;rnH6aF;m2!vJ8@v8C=Cs:aQS\.Qw',

	// If the web server responds to both HTTP and HTTPS requests but you want
	// users to connect with only HTTPS, you can set this to true to make
	// Phabricator redirect HTTP requests to HTTPS.
	//
	// Normally, you should just configure your server not to accept HTTP traffic,
	// but this setting may be useful if you originally used HTTP and have now
	// switched to HTTPS but don't want to break old links, or if your webserver
	// sits behind a load balancer which terminates HTTPS connections and you
	// can not reasonably configure more granular behavior there.
	//
	// NOTE: Phabricator determines if a request is HTTPS or not by examining the
	// PHP $_SERVER['HTTPS'] variable. If you run Apache/mod_php this will
	// probably be set correctly for you automatically, but if you run Phabricator
	// as CGI/FCGI (e.g., through nginx or lighttpd), you need to configure your
	// web server so that it passes the value correctly based on the connection
	// type. Alternatively, you can add a PHP snippet to the top of this
	// configuration file to directly set $_SERVER['HTTPS'] to the correct value.
	'security.require-https' => false,

	// Is Phabricator permitted to make outbound HTTP requests?
	'security.allow-outbound-http' => true,


	// -- Internationalization -------------------------------------------------- //

	// This allows customizing texts used in Phabricator. The class must extend
	// PhabricatorTranslation.
	'translation.provider' => 'PhabricatorEnglishTranslation',

	// You can use 'translation.override' if you don't want to create a full
	// translation to give users an option for switching to it and you just want
	// to override some strings in the default translation.
	'translation.override' => array(),


	// -- Access Policies ------------------------------------------------------- //

	// Phabricator allows you to set the visibility of objects (like repositories
	// and source code) to "Public", which means anyone on the internet can see
	// them, even without being logged in. This is great for open source, but
	// some installs may never want to make anything public, so this policy is
	// disabled by default. You can enable it here, which will let you set the
	// policy for objects to "Public". With this option disabled, the most open
	// policy is "All Users", which means users must be logged in to view things.
	'policy.allow-public' => false,


	// -- Logging --------------------------------------------------------------- //

	// To enable the Phabricator access log, specify a path here. The Phabricator
	// access log can provide more detailed information about Phabricator access
	// than normal HTTP access logs (for instance, it can show logged-in users,
	// controllers, and other application data). If not set, no log will be
	// written.
	//
	// Make sure the PHP process can write to the log!
	'log.access.path' => null,

	// Format for the access log. If not set, the default format will be used:
	//
	// "[%D]\t%h\t%u\t%M\t%C\t%m\t%U\t%c\t%T"
	//
	// Available variables are:
	//
	// - %c The HTTP response code.
	// - %C The controller which handled the request.
	// - %D The request date.
	// - %e Epoch timestamp.
	// - %h The webserver's host name.
	// - %p The PID of the server process.
	// - %R The HTTP referrer.
	// - %r The remote IP.
	// - %T The request duration, in microseconds.
	// - %U The request path.
	// - %u The logged-in username, if one is logged in.
	// - %P The logged-in user PHID, if one is logged in.
	// - %M The HTTP method.
	// - %m For conduit, the Conduit method which was invoked.
	//
	// If a variable isn't available (for example, %m appears in the file format
	// but the request is not a Conduit request), it will be rendered as "-".
	//
	// Note that the default format is subject to change in the future, so if you
	// rely on the log's format, specify it explicitly.
	'log.access.format' => null,


	// -- DarkConsole ----------------------------------------------------------- //

	// DarkConsole is a administrative debugging/profiling tool built into
	// Phabricator. You can leave it disabled unless you're developing against
	// Phabricator.

	// Determines whether or not DarkConsole is available. DarkConsole exposes
	// some data like queries and stack traces, so you should be careful about
	// turning it on in production (although users can not normally see it, even
	// if the deployment configuration enables it).
	'darkconsole.enabled' => false,

	// Always enable DarkConsole, even for logged out users. This potentially
	// exposes sensitive information to users, so make sure untrusted users can
	// not access an install running in this mode. You should definitely leave
	// this off in production. It is only really useful for using DarkConsole
	// utilities to debug or profile logged-out pages. You must set
	// 'darkconsole.enabled' to use this option.
	'darkconsole.always-on' => false,

	// Map of additional configuration values to lock.
	'config.lock' => array(),

	// Map of additional configuration values to hide.
	'config.hide' => array(),

	// Map of additional configuration values to mask.
	'config.mask' => array(),

	// Ignore setup warnings of the following issues.
	'config.ignore-issues' => array(),

	// -- MySQL --------------------------------------------------------------- //

	// Class providing database configuration. It must implement
	// DatabaseConfigurationProvider.
	'mysql.configuration-provider' => 'DefaultDatabaseConfigurationProvider',

	// The username to use when connecting to MySQL.
	'mysql.user' => 'root',

	// The password to use when connecting to MySQL.
	'mysql.pass' => '',

	// The MySQL server to connect to. If you want to connect to a different
	// port than the default (which is 3306), specify it in the hostname
	// (e.g., db.example.com:1234).
	'mysql.host' => 'localhost',

	// Phabricator supports PHP extensions MySQL and MySQLi. It is possible to
	// implement also other access mechanism (e.g. PDO_MySQL). The class must
	// extend AphrontMySQLDatabaseConnectionBase.
	'mysql.implementation' => (extension_loaded('mysqli')
	? 'AphrontMySQLiDatabaseConnection'
	: 'AphrontMySQLDatabaseConnection'),


	// -- Notifications --------------------------------------------------------- //

	// Set this to true to enable real-time notifications. You must also run a
	// notification server for this to work. Consult the documentation in
	// "Notifications User Guide: Setup and Configuration" for instructions.
	'notification.enabled' => false,

	// Client port for the realtime server to listen on, and for realtime clients
	// to connect to. Use "localhost" if you are running the notification server
	// on the same host as the web server.
	'notification.client-uri' => 'http://localhost:22280/',

	// URI and port for the notification root server.
	'notification.server-uri' => 'http://localhost:22281/',

	// The server must be started as root so it can bind to privileged ports, but
	// if you specify a user here it will drop permissions after binding.
	'notification.user' => null,

	// Location where the server should log to.
	'notification.log' => '/var/log/aphlict.log',

	// PID file to use.
	'notification.pidfile' => '/var/run/aphlict.pid',

	// Enable this option to get additional debug output in the browser.
	'notification.debug' => false,


	// -- Email ----------------------------------------------------------------- //

	// Some Phabricator tools send email notifications, e.g. when Differential
	// revisions are updated or Maniphest tasks are changed. These options allow
	// you to configure how email is delivered.

	// You can test your mail setup by going to "MetaMTA" in the web interface,
	// clicking "Send New Message", and then composing a message.

	// Default address to send mail "From".
	'metamta.default-address' => 'noreply@example.com',

	// Domain used to generate Message-IDs.
	'metamta.domain' => 'example.com',

	// When a message is sent to multiple recipients (for example, several
	// reviewers on a code review), Phabricator can either deliver one email to
	// everyone (e.g., "To: alincoln, usgrant, htaft") or separate emails to each
	// user (e.g., "To: alincoln", "To: usgrant", "To: htaft"). The major
	// advantages and disadvantages of each approach are:
	//
	// - One mail to everyone:
	// - Recipients can see To/Cc at a glance.
	// - If you use mailing lists, you won't get duplicate mail if you're
	// a normal recipient and also Cc'd on a mailing list.
	// - Getting threading to work properly is harder, and probably requires
	// making mail less useful by turning off options.
	// - Sometimes people will "Reply All" and everyone will get two mails,
	// one from the user and one from Phabricator turning their mail into
	// a comment.
	// - Not supported with a private reply-to address.
	// - Mails are sent in the server default translation.
	// - One mail to each user:
	// - Recipients need to look in the mail body to see To/Cc.
	// - If you use mailing lists, recipients may sometimes get duplicate
	// mail.
	// - Getting threading to work properly is easier, and threading settings
	// can be customzied by each user.
	// - "Reply All" no longer spams all other users.
	// - Required if private reply-to addresses are configured.
	// - Mails are sent in the language of user preference.
	//
	// In the code, splitting one outbound email into one-per-recipient is
	// sometimes referred to as "multiplexing".
	'metamta.one-mail-per-recipient' => true,

	// When sending a message that has no To recipient (i.e. all recipients
	// are CC'd, for example when multiplexing mail), set the To field to the
	// following value. If no value is set, messages with no To will have
	// their CCs upgraded to To.
	'metamta.placeholder-to-recipient' => null,

	// When a user takes an action which generates an email notification (like
	// commenting on a Differential revision), Phabricator can either send that
	// mail "From" the user's email address (like "alincoln@logcabin.com") or
	// "From" the 'metamta.default-address' address. The user experience is
	// generally better if Phabricator uses the user's real address as the "From"
	// since the messages are easier to organize when they appear in mail clients,
	// but this will only work if the server is authorized to send email on behalf
	// of the "From" domain. Practically, this means:
	// - If you are doing an install for Example Corp and all the users will
	// have corporate @corp.example.com addresses and any hosts Phabricator
	// is running on are authorized to send email from corp.example.com,
	// you can enable this to make the user experience a little better.
	// - If you are doing an install for an open source project and your
	// users will be registering via Facebook and using personal email
	// addresses, you MUST NOT enable this or virtually all of your outgoing
	// email will vanish into SFP blackholes.
	// - If your install is anything else, you're much safer leaving this
	// off since the risk in turning it on is that your outgoing mail will
	// mostly never arrive.
	'metamta.can-send-as-user' => false,

	// Limit the maximum size of the body of an email generated for a diff
	// (in bytes).
	'metamta.email-body-limit' => 524288,

	// Adapter class to use to transmit mail to the MTA. The default uses
	// PHPMailerLite, which will invoke "sendmail". This is appropriate
	// if sendmail actually works on your host, but if you haven't configured mail
	// it may not be so great. A number of other mailers are available (e.g., SES,
	// SendGrid, SMTP, custom mailers), consult "Configuring Outbound Email" in
	// the documentation for details.
	'metamta.mail-adapter' =>
	'PhabricatorMailImplementationPHPMailerLiteAdapter',

	// When email is sent, try to hand it off to the MTA immediately instead of
	// queueing it for delivery by the daemons. If you are running the Phabricator
	// daemons with "phd start", you should disable this to provide a (sometimes
	// substantial) performance boost. It's on by default to make setup and
	// configuration a little easier.
	'metamta.send-immediately' => true,

	// When email is sent, what format should Phabricator use for user's
	// email addresses? Valid values are:
	// - 'short' - 'gwashington <gwashington@example.com>'
	// - 'real' - 'George Washington <gwashington@example.com>'
	// - 'full' - 'gwashington (George Washington) <gwashington@example.com>'
	// The default is 'full'.
	'metamta.user-address-format' => 'full',

	// If you're using PHPMailer to send email, provide the mailer and options
	// here. PHPMailer is much more enormous than PHPMailerLite, and provides more
	// mailers and greater enormity. You need it when you want to use SMTP
	// instead of sendmail as the mailer.
	'phpmailer.mailer' => 'smtp',
	'phpmailer.smtp-host' => '',
	'phpmailer.smtp-port' => 25,

	// When using PHPMailer with SMTP, you can set this to one of "tls" or "ssl"
	// to use TLS or SSL. Leave it blank for vanilla SMTP. If you're sending
	// via Gmail, set it to "ssl".
	'phpmailer.smtp-protocol' => '',

	// Set following if your smtp server requires authentication.
	'phpmailer.smtp-user' => null,
	'phpmailer.smtp-password' => null,

	// If you're using Amazon SES to send email, provide your AWS access key
	// and AWS secret key here. To set up Amazon SES with Phabricator, you need
	// to:
	// - Make sure 'metamta.mail-adapter' is set to:
	// "PhabricatorMailImplementationAmazonSESAdapter"
	// - Make sure 'metamta.can-send-as-user' is false.
	// - Make sure 'metamta.default-address' is configured to something sensible.
	// - Make sure 'metamta.default-address' is a validated SES "From" address.
	'amazon-ses.access-key' => null,
	'amazon-ses.secret-key' => null,

	// If you're using Sendgrid to send email, provide your access credentials
	// here. This will use the REST API. You can also use Sendgrid as a normal
	// SMTP service.
	'sendgrid.api-user' => null,
	'sendgrid.api-key' => null,

	// You can configure a reply handler domain so that email sent from Maniphest
	// will have a special "Reply To" address like "T123+82+af19f@example.com"
	// that allows recipients to reply by email and interact with tasks. For
	// instructions on configurating reply handlers, see the article
	// "Configuring Inbound Email" in the Phabricator documentation. By default,
	// this is set to 'null' and Phabricator will use a generic 'noreply@' address
	// or the address of the acting user instead of a special reply handler
	// address (see 'metamta.default-address'). If you set a domain here,
	// Phabricator will begin generating private reply handler addresses. See
	// also 'metamta.maniphest.reply-handler' to further configure behavior.
	// This key should be set to the domain part after the @, like "example.com".
	'metamta.maniphest.reply-handler-domain' => null,

	// You can follow the instructions in "Configuring Inbound Email" in the
	// Phabricator documentation and set 'metamta.maniphest.reply-handler-domain'
	// to support updating Maniphest tasks by email. If you want more advanced
	// customization than this provides, you can override the reply handler
	// class with an implementation of your own. This will allow you to do things
	// like have a single public reply handler or change how private reply
	// handlers are generated and validated.
	//
	// This key should be set to a loadable subclass of
	// PhabricatorMailReplyHandler.
	'metamta.maniphest.reply-handler' => 'ManiphestReplyHandler',

	// If you don't want phabricator to take up an entire domain
	// (or subdomain for that matter), you can use this and set a common
	// prefix for mail sent by phabricator. It will make use of the fact that
	// a mail-address such as phabricator+D123+1hjk213h@example.com will be
	// delivered to the phabricator users mailbox.
	// Set this to the left part of the email address and it well get
	// prepended to all outgoing mail. If you want to use e.g.
	// 'phabricator@example.com' this should be set to 'phabricator'.
	'metamta.single-reply-handler-prefix' => null,

	// Prefix prepended to mail sent by Maniphest. You can change this to
	// distinguish between testing and development installs, for example.
	'metamta.maniphest.subject-prefix' => '[Maniphest]',

	// See 'metamta.maniphest.reply-handler-domain'. This does the same thing, but
	// affects Pholio.
	'metamta.pholio.reply-handler-domain' => null,

	// Prefix prepended to mail sent by Pholio.
	'metamta.pholio.subject-prefix' => '[Pholio]',

	// See 'metamta.maniphest.reply-handler-domain'. This does the same thing, but
	// affects Macro.
	'metamta.macro.reply-handler-domain' => null,

	// Prefix prepended to mail sent by Macro.
	'metamta.macro.subject-prefix' => '[Macro]',

	// See 'metamta.maniphest.reply-handler-domain'. This does the same thing,
	// but allows email replies via Differential.
	'metamta.differential.reply-handler-domain' => null,

	// See 'metamta.maniphest.reply-handler'. This does the same thing, but
	// affects Differential.
	'metamta.differential.reply-handler' => 'DifferentialReplyHandler',

	// Prefix prepended to mail sent by Differential.
	'metamta.differential.subject-prefix' => '[Differential]',

	// Set this to true if you want patches to be attached to mail from
	// Differential. This won't work if you are using SendGrid as your mail
	// adapter.
	'metamta.differential.attach-patches' => false,

	// To include patches in email bodies, set this to a positive integer. Patches
	// will be inlined if they are at most that many lines. For instance, a value
	// of 100 means "inline patches if they are no longer than 100 lines". By
	// default, patches are not inlined.
	'metamta.differential.inline-patches' => 0,

	// If you enable either of the options above, you can choose what format
	// patches are sent in. Valid options are 'unified' (like diff -u) or 'git'.
	'metamta.differential.patch-format' => 'unified',

	// Enables a different format for comments in differential emails.
	// Differential will create unified diffs around the comment, which
	// will give enough context for people who are only viewing the
	// reviews in email to understand what is going on. The context will
	// be created based on the range of the comment.
	'metamta.differential.unified-comment-context' => false,

	// Prefix prepended to mail sent by Diffusion.
	'metamta.diffusion.subject-prefix' => '[Diffusion]',

	// See 'metamta.maniphest.reply-handler-domain'. This does the same thing,
	// but allows email replies via Diffusion.
	'metamta.diffusion.reply-handler-domain' => null,

	// See 'metamta.maniphest.reply-handler'. This does the same thing, but
	// affects Diffusion.
	'metamta.diffusion.reply-handler' => 'PhabricatorAuditReplyHandler',

	// Set this to true if you want patches to be attached to commit notifications
	// from Diffusion. This won't work with SendGrid.
	'metamta.diffusion.attach-patches' => false,

	// To include patches in Diffusion email bodies, set this to a positive
	// integer. Patches will be inlined if they are at most that many lines.
	// By default, patches are not inlined.
	'metamta.diffusion.inline-patches' => 0,

	// If you've enabled attached patches or inline patches for commit emails, you
	// can establish a hard byte limit on their size. You should generally set
	// reasonable byte and time limits (defaults are 1MB and 60 seconds) to avoid
	// sending ridiculously enormous email for changes like "importing an external
	// library" or "accidentally committed this full-length movie as text".
	'metamta.diffusion.byte-limit' => 1024 * 1024,

	// If you've enabled attached patches or inline patches for commit emails, you
	// can establish a hard time limit on generating them.
	'metamta.diffusion.time-limit' => 60,

	// Prefix prepended to mail sent by Package.
	'metamta.package.subject-prefix' => '[Package]',

	// See 'metamta.maniphest.reply-handler'. This does similar thing for package
	// except that it only supports sending out mail and doesn't handle incoming
	// email.
	'metamta.package.reply-handler' => 'OwnersPackageReplyHandler',

	// By default, Phabricator generates unique reply-to addresses and sends a
	// separate email to each recipient when you enable reply handling. This is
	// more secure than using "From" to establish user identity, but can mean
	// users may receive multiple emails when they are on mailing lists. Instead,
	// you can use a single, non-unique reply to address and authenticate users
	// based on the "From" address by setting this to 'true'. This trades away
	// a little bit of security for convenience, but it's reasonable in many
	// installs. Object interactions are still protected using hashes in the
	// single public email address, so objects can not be replied to blindly.
	'metamta.public-replies' => false,

	// You can configure an email address like "bugs@phabricator.example.com"
	// which will automatically create Maniphest tasks when users send email
	// to it. This relies on the "From" address to authenticate users, so it is
	// is not completely secure. To set this up, enter a complete email
	// address like "bugs@phabricator.example.com" and then configure mail to
	// that address so it routed to Phabricator (if you've already configured
	// reply handlers, you're probably already done). See "Configuring Inbound
	// Email" in the documentation for more information.
	'metamta.maniphest.public-create-email' => null,

	// If you enable 'metamta.public-replies', Phabricator uses "From" to
	// authenticate users. You can additionally enable this setting to try to
	// authenticate with 'Reply-To'. Note that this is completely spoofable and
	// insecure (any user can set any 'Reply-To' address) but depending on the
	// nature of your install or other deliverability conditions this might be
	// okay. Generally, you can't do much more by spoofing Reply-To than be
	// annoying (you can write but not read content). But, you know, this is
	// still COMPLETELY INSECURE.
	'metamta.insecure-auth-with-reply-to' => false,

	// If you enable 'metamta.maniphest.public-create-email' and create an
	// email address like "bugs@phabricator.example.com", it will default to
	// rejecting mail which doesn't come from a known user. However, you might
	// want to let anyone send email to this address; to do so, set a default
	// author here (a Phabricator username). A typical use of this might be to
	// create a "System Agent" user called "bugs" and use that name here. If you
	// specify a valid username, mail will always be accepted and used to create
	// a task, even if the sender is not a system user. The original email
	// address will be stored in an 'From Email' field on the task.
	'metamta.maniphest.default-public-author' => null,

	// You can disable the Herald hints in email if users prefer smaller messages.
	// These are the links under the headers "MANAGE HERALD RULES" and
	// "WHY DID I GET THIS EMAIL?". If you set this to true, they will not appear
	// in any mail. Users can still navigate to the links via the web interface.
	'metamta.herald.show-hints' => true,

	// You can disable the hints under "REPLY HANDLER ACTIONS" if users prefer
	// smaller messages. The actions themselves will still work properly.
	'metamta.reply.show-hints' => true,

	// You can disable the "To:" and "Cc:" footers in mail if users prefer
	// smaller messages.
	'metamta.recipients.show-hints' => true,

	// If this option is enabled, Phabricator will add a "Precedence: bulk"
	// header to transactional mail (e.g., Differential, Maniphest and Herald
	// notifications). This may improve the behavior of some auto-responder
	// software and prevent it from replying. However, it may also cause
	// deliverability issues -- notably, you currently can not send this header
	// via Amazon SES, and enabling this option with SES will prevent delivery
	// of any affected mail.
	'metamta.precedence-bulk' => false,

	// Mail.app on OS X Lion won't respect threading headers unless the subject
	// is prefixed with "Re:". If you enable this option, Phabricator will add
	// "Re:" to the subject line of all mail which is expected to thread. If
	// you've set 'metamta.one-mail-per-recipient', users can override this
	// setting in their preferences.
	'metamta.re-prefix' => false,

	// If true, allow MetaMTA to change mail subjects to put text like
	// '[Accepted]' and '[Commented]' in them. This makes subjects more useful,
	// but might break threading on some clients. If you've set
	// 'metamta.one-mail-per-recipient', users can override this setting in their
	// preferences.
	'metamta.vary-subjects' => true,

	// -- Auth ------------------------------------------------------------------ //

	- // Can users login with a username/password, or by following the link from
	- // a password reset email? You can disable this and configure one or more
	- // OAuth providers instead.
	- 'auth.password-auth-enabled' => true,
	-
	// Maximum number of simultaneous web sessions each user is permitted to have.
	// Setting this to "1" will prevent a user from logging in on more than one
	// browser at the same time.
	'auth.sessions.web' => 5,

	// Maximum number of simultaneous Conduit sessions each user is permitted
	// to have.
	'auth.sessions.conduit' => 5,

	// Set this true to enable the Settings -> SSH Public Keys panel, which will
	// allow users to associated SSH public keys with their accounts. This is only
	// really useful if you're setting up services over SSH and want to use
	// Phabricator for authentication; in most situations you can leave this
	// disabled.
	'auth.sshkeys.enabled' => false,

	// If true, email addresses must be verified (by clicking a link in an
	// email) before a user can login. By default, verification is optional
	// unless 'auth.email-domains' is nonempty (see below).
	'auth.require-email-verification' => false,

	// You can restrict allowed email addresses to certain domains (like
	// "yourcompany.com") by setting a list of allowed domains here. Users will
	// only be allowed to register using email addresses at one of the domains,
	// and will only be able to add new email addresses for these domains. If
	// you configure this, it implies 'auth.require-email-verification'.
	//
	// To configure email domains, set a list of domains like this:
	//
	// array(
	// 'yourcompany.com',
	// 'yourcompany.co.uk',
	// )
	//
	// You should omit the "@" from domains. Note that the domain must match
	// exactly. If you allow "yourcompany.com", that permits "joe@yourcompany.com"
	// but rejects "joe@mail.yourcompany.com".
	'auth.email-domains' => array(),

	// You can provide an arbitrary block of HTML here, which will appear on the
	// login screen. Normally, you'd use this to provide login or registration
	// instructions to users.
	'auth.login-message' => null,


	// -- Accounts -------------------------------------------------------------- //

	// Is basic account information (email, real name, profile picture) editable?
	// If you set up Phabricator to automatically synchronize account information
	// from some other authoritative system, you can disable this to ensure
	// information remains consistent across both systems.
	'account.editable' => true,

	// When users set or reset a password, it must have at least this many
	// characters.
	'account.minimum-password-length' => 8,


	// -- Recaptcha ------------------------------------------------------------- //

	// Is Recaptcha enabled? If disabled, captchas will not appear. You should
	// enable Recaptcha if your install is public-facing, as it hinders
	// brute-force attacks.
	'recaptcha.enabled' => false,

	// Your Recaptcha public key, obtained from Recaptcha.
	'recaptcha.public-key' => null,

	// Your Recaptcha private key, obtained from Recaptcha.
	'recaptcha.private-key' => null,


	// -- Misc ------------------------------------------------------------------ //

	// This is hashed with other inputs to generate CSRF tokens. If you want, you
	// can change it to some other string which is unique to your install. This
	// will make your install more secure in a vague, mostly theoretical way. But
	// it will take you like 3 seconds of mashing on your keyboard to set it up so
	// you might as well.
	'phabricator.csrf-key' => '0b7ec0592e0a2829d8b71df2fa269b2c6172eca3',

	// This is hashed with other inputs to generate mail tokens. If you want, you
	// can change it to some other string which is unique to your install. In
	// particular, you will want to do this if you accidentally send a bunch of
	// mail somewhere you shouldn't have, to invalidate all old reply-to
	// addresses.
	'phabricator.mail-key' => '5ce3e7e8787f6e40dfae861da315a5cdf1018f12',


	// PHP requires that you set a timezone in your php.ini before using date
	// functions, or it will emit a warning. If this isn't possible (for instance,
	// because you are using HPHP) you can set some valid constant for
	// date_default_timezone_set() here and Phabricator will set it on your
	// behalf, silencing the warning.
	'phabricator.timezone' => null,

	// Show stack traces when unhandled exceptions occur, force reloading of
	// static resources (skipping the cache), show an error callout if a page
	// generated PHP errors, warnings, or notices, force disk reads when
	// reloading, and generally make development easier. This option should not
	// be enabled in production.
	'phabricator.developer-mode' => false,

	// When users write comments which have URIs, they'll be automatically linked
	// if the protocol appears in this set. This whitelist is primarily to prevent
	// security issues like javascript:// URIs.
	'uri.allowed-protocols' => array(
	'http' => true,
	'https' => true,
	),

	// Tokenizers are UI controls which let the user select other users, email
	// addresses, project names, etc., by typing the first few letters and having
	// the control autocomplete from a list. They can load their data in two ways:
	// either in a big chunk up front, or as the user types. By default, the data
	// is loaded in a big chunk. This is simpler and performs better for small
	// datasets. However, if you have a very large number of users or projects,
	// (in the ballpark of more than a thousand), loading all that data may become
	// slow enough that it's worthwhile to query on demand instead. This makes
	// the typeahead slightly less responsive but overall performance will be much
	// better if you have a ton of stuff. You can figure out which setting is
	// best for your install by changing this setting and then playing with a
	// user tokenizer (like the user selectors in Maniphest or Differential) and
	// seeing which setting loads faster and feels better.
	'tokenizer.ondemand' => false,

	// By default, Phabricator includes some silly nonsense in the UI, such as
	// a submit button called "Clowncopterize" in Differential and a call to
	// "Leap Into Action". If you'd prefer more traditional UI strings like
	// "Submit", you can set this flag to disable most of the jokes and easter
	// eggs.
	'phabricator.serious-business' => false,

	// Should Phabricator show beta applications on the homepage
	'phabricator.show-beta-applications' => false,

	// Contains a list of uninstalled applications
	'phabricator.uninstalled-applications' => array(),

	// Allowing non-members to interact with tasks over email.
	'phabricator.allow-email-users' => false,

	// -- Welcome Screen -------------------------------------------------------- //

	// The custom HTML content for the Phabricator welcome screen.
	'welcome.html' => null,

	// -- Files ----------------------------------------------------------------- //

	// Lists which uploaded file types may be viewed in the browser. If a file
	// has a mime type which does not appear in this list, it will always be
	// downloaded instead of displayed. This is mainly a usability
	// consideration, since browsers tend to freak out when viewing enormous
	// binary files.
	//
	// The keys in this array are viewable mime types; the values are the mime
	// types they will be delivered as when they are viewed in the browser.
	//
	// IMPORTANT: Configure 'security.alternate-file-domain' above! Your install
	// is NOT safe if it is left unconfigured.
	'files.viewable-mime-types' => array(
	'image/jpeg' => 'image/jpeg',
	'image/jpg' => 'image/jpg',
	'image/png' => 'image/png',
	'image/gif' => 'image/gif',
	'text/plain' => 'text/plain; charset=utf-8',
	'text/x-diff' => 'text/plain; charset=utf-8',

	// ".ico" favicon files, which have mime type diversity. See:
	// http://en.wikipedia.org/wiki/ICO_(file_format)#MIME_type
	'image/x-ico' => 'image/x-icon',
	'image/x-icon' => 'image/x-icon',
	'image/vnd.microsoft.icon' => 'image/x-icon',
	),

	// List of mime types which can be used as the source for an <img /> tag.
	// This should be a subset of 'files.viewable-mime-types' and exclude files
	// like text.
	'files.image-mime-types' => array(
	'image/jpeg' => true,
	'image/jpg' => true,
	'image/png' => true,
	'image/gif' => true,
	'image/x-ico' => true,
	'image/x-icon' => true,
	'image/vnd.microsoft.icon' => true,
	),

	// Configuration option for enabling imagemagick
	// to resize animated profile pictures (gif)
	'files.enable-imagemagick' => false,

	// -- Storage --------------------------------------------------------------- //

	// Phabricator allows users to upload files, and can keep them in various
	// storage engines. This section allows you to configure which engines
	// Phabricator will use, and how it will use them.

	// The largest filesize Phabricator will store in the MySQL BLOB storage
	// engine, which just uses a database table to store files. While this isn't a
	// best practice, it's really easy to set up. Set this to 0 to disable use of
	// the MySQL blob engine.
	'storage.mysql-engine.max-size' => 1000000,

	// Phabricator provides a local disk storage engine, which just writes files
	// to some directory on local disk. The webserver must have read/write
	// permissions on this directory. This is straightforward and suitable for
	// most installs, but will not scale past one web frontend unless the path
	// is actually an NFS mount, since you'll end up with some of the files
	// written to each web frontend and no way for them to share. To use the
	// local disk storage engine, specify the path to a directory here. To
	// disable it, specify null.
	'storage.local-disk.path' => null,

	// If you want to store files in Amazon S3, specify an AWS access and secret
	// key here and a bucket name below.
	'amazon-s3.access-key' => null,
	'amazon-s3.secret-key' => null,

	// To use a custom endpoint, specify it here. Normally, you do not need to
	// configure this.
	'amazon-s3.endpoint' => null,

	// Set this to a valid Amazon S3 bucket to store files there. You must also
	// configure S3 access keys above.
	'storage.s3.bucket' => null,

	// Phabricator uses a storage engine selector to choose which storage engine
	// to use when writing file data. If you add new storage engines or want to
	// provide very custom rules (e.g., write images to one storage engine and
	// other files to a different one), you can provide an alternate
	// implementation here. The default engine will use choose MySQL, Local Disk,
	// and S3, in that order, if they have valid configurations above and a file
	// fits within configured limits.
	'storage.engine-selector' => 'PhabricatorDefaultFileStorageEngineSelector',

	// Set the size of the largest file a user may upload. This is used to render
	// text like "Maximum file size: 10MB" on interfaces where users can upload
	// files, and files larger than this size will be rejected.
	//
	// Specify this limit in bytes, or using a "K", "M", or "G" suffix.
	//
	// NOTE: Setting this to a large size is NOT sufficient to allow users to
	// upload large files. You must also configure a number of other settings. To
	// configure file upload limits, consult the article "Configuring File Upload
	// Limits" in the documentation. Once you've configured some limit across all
	// levels of the server, you can set this limit to an appropriate value and
	// the UI will then reflect the actual configured limit.
	'storage.upload-size-limit' => null,

	// Phabricator puts databases in a namespace, which defualts to "phabricator"
	// -- for instance, the Differential database is named
	// "phabricator_differential" by default. You can change this namespace if you
	// want. Normally, you should not do this unless you are developing
	// Phabricator and using namespaces to separate multiple sandbox datasets.
	'storage.default-namespace' => 'phabricator',


	// -- Search ---------------------------------------------------------------- //

	// Phabricator supports Elastic Search; to use it, specify a host like
	// 'http://elastic.example.com:9200/' here.
	'search.elastic.host' => null,

	// Phabricator uses a search engine selector to choose which search engine
	// to use when indexing and reconstructing documents, and when executing
	// queries. You can override the engine selector to provide a new selector
	// class which can select some custom engine you implement, if you want to
	// store your documents in some search engine which does not have default
	// support.
	'search.engine-selector' => 'PhabricatorDefaultSearchEngineSelector',


	// -- Differential ---------------------------------------------------------- //

	'differential.revision-custom-detail-renderer' => null,

	// Array for custom remarkup rules. The array should have a list of
	// class names of classes that extend PhutilRemarkupRule
	'differential.custom-remarkup-rules' => null,

	// Array for custom remarkup block rules. The array should have a list of
	// class names of classes that extend PhutilRemarkupEngineBlockRule
	'differential.custom-remarkup-block-rules' => null,

	// List of file regexps where whitespace is meaningful and should not
	// use 'ignore-all' by default
	'differential.whitespace-matters' => array(
	'/\.py$/',
	'/\.l?hs$/',
	),

	'differential.field-selector' => 'DifferentialDefaultFieldSelector',

	// Differential can show "Host" and "Path" fields on revisions, with
	// information about the machine and working directory where the
	// change came from. These fields are disabled by default because they may
	// occasionally have sensitive information; you can set this to true to
	// enable them.
	'differential.show-host-field' => false,

	// Differential has a required "Test Plan" field by default, which requires
	// authors to fill out information about how they verified the correctness of
	// their changes when sending code for review. If you'd prefer not to use
	// this field, you can disable it here. You can also make it optional
	// (instead of required) below.
	'differential.show-test-plan-field' => true,

	// Differential has a required "Test Plan" field by default. You can make it
	// optional by setting this to false. You can also completely remove it above,
	// if you prefer.
	'differential.require-test-plan-field' => true,

	// If you set this to true, users can "!accept" revisions via email (normally,
	// they can take other actions but can not "!accept"). This action is disabled
	// by default because email authentication can be configured to be very weak,
	// and, socially, email "!accept" is kind of sketchy and implies revisions may
	// not actually be receiving thorough review.
	'differential.enable-email-accept' => false,

	// If you set this to true, users won't need to login to view differential
	// revisions. Anonymous users will have read-only access and won't be able to
	// interact with the revisions.
	'differential.anonymous-access' => false,

	// List of file regexps that should be treated as if they are generated by
	// an automatic process, and thus get hidden by default in differential.
	'differential.generated-paths' => array(
	// '/config\.h$/',
	// '#/autobuilt/#',
	),

	// If you set this to true, users can accept their own revisions. This action
	// is disabled by default because it's most likely not a behavior you want,
	// but it proves useful if you are working alone on a project and want to make
	// use of all of differential's features.
	'differential.allow-self-accept' => false,

	// If you set this to true, any user can close any revision so long as it has
	// been accepted. This can be useful depending on your development model. For
	// example, github-style pull requests where the reviewer is often the
	// actual committer can benefit from turning this option to true. If false,
	// only the submitter can close a revision.
	'differential.always-allow-close' => false,

	// If you set this to true, any user can reopen a revision so long as it has
	// been closed. This can be useful if a revision is accidentally closed or
	// if a developer changes his or her mind after closing a revision. If it is
	// false, reopening is not allowed.
	'differential.allow-reopen' => false,

	// Revisions newer than this number of days are marked as fresh in Action
	// Required and Revisions Waiting on You views. Only work days (not weekends
	// and holidays) are included. Set to 0 to disable this feature.
	'differential.days-fresh' => 1,

	// Similar to 'differential.days-fresh' but marks stale revisions. If the
	// revision is even older than it is marked as old.
	'differential.days-stale' => 3,

	// -- Repositories ---------------------------------------------------------- //

	// The default location in which to store local copies of repositories.
	// Anything stored in this directory will be assumed to be under the
	// control of phabricator, which means that Phabricator will try to do some
	// maintenance on working copies if there are problems (such as a change
	// to the remote origin url). This maintenance may include completely
	// removing (and recloning) anything in this directory.
	//
	// When set to null, this option is ignored (i.e. Phabricator will not fully
	// control any working copies).
	'repository.default-local-path' => null,

	// -- Maniphest ------------------------------------------------------------- //

	// Array of custom fields for Maniphest tasks. For details on adding custom
	// fields to Maniphest, see "Maniphest User Guide: Adding Custom Fields".
	'maniphest.custom-fields' => array(),

	// Class which drives custom field construction. See "Maniphest User Guide:
	// Adding Custom Fields" in the documentation for more information.
	'maniphest.custom-task-extensions-class' => 'ManiphestDefaultTaskExtensions',

	// What should the default task priority be in create flows?
	// See the constants in @{class:ManiphestTaskPriority} for valid values.
	// Defaults to "needs triage".
	'maniphest.default-priority' => 90,

	// -- Phame ----------------------------------------------------------------- //

	// Should Phame users have Disqus comment widget, and if so what's the
	// website shortname to use? For example, secure.phabricator.org uses
	// "phabricator", which we registered with Disqus. If you aren't familiar
	// with Disqus, see:
	// Disqus quick start guide - http://docs.disqus.com/help/4/
	// Information on shortnames - http://docs.disqus.com/help/68/
	'disqus.shortname' => null,

	// Directories to look for Phame skins inside of.
	'phame.skins' => array(
	'externals/skins/',
	),

	// -- Remarkup -------------------------------------------------------------- //

	// If you enable this, linked YouTube videos will be embeded inline. This has
	// mild security implications (you'll leak referrers to YouTube) and is pretty
	// silly (but sort of awesome).
	'remarkup.enable-embedded-youtube' => false,


	// -- Cache ----------------------------------------------------------------- //

	// Set this to false to disable the use of gzdeflate()-based compression in
	// some caches. This may give you less performant (but more debuggable)
	// caching.
	'cache.enable-deflate' => true,

	// -- Garbage Collection ---------------------------------------------------- //

	// Phabricator generates various logs and caches in the database which can
	// be garbage collected after a while to make the total data size more
	// manageable. To run garbage collection, launch a
	// PhabricatorGarbageCollector daemon.

	// These 'ttl' keys configure how much old data the GC daemon keeps around.
	// Objects older than the ttl will be collected. Set any value to 0 to store
	// data indefinitely.

	'gcdaemon.ttl.herald-transcripts' => 30 * (24 * 60 * 60),
	'gcdaemon.ttl.daemon-logs' => 7 * (24 * 60 * 60),
	'gcdaemon.ttl.differential-parse-cache' => 14 * (24 * 60 * 60),
	'gcdaemon.ttl.markup-cache' => 30 * (24 * 60 * 60),
	'gcdaemon.ttl.task-archive' => 14 * (24 * 60 * 60),
	'gcdaemon.ttl.general-cache' => 30 * (24 * 60 * 60),


	// -- Feed ------------------------------------------------------------------ //

	// If you set this to true, you can embed Phabricator activity feeds in other
	// pages using iframes. These feeds are completely public, and a login is not
	// required to view them! This is intended for things like open source
	// projects that want to expose an activity feed on the project homepage.
	//
	// NOTE: You must also set `policy.allow-public` to true for this setting
	// to work properly.
	'feed.public' => false,

	// If you set this to a list of http URIs, when a feed story is published a
	// task will be created for each uri that posts the story data to the uri.
	// Daemons automagically retry failures 100 times, waiting $fail_count * 60s
	// between each subsequent failure. Be sure to keep the daemon console
	// (/daemon/) open while developing and testing your end points.
	//
	// NOTE: URIs are not validated, the URI must return http status 200 within
	// 30 seconds, and no permission checks are performed.
	'feed.http-hooks' => array(),

	// -- Drydock --------------------------------------------------------------- //

	// If you want to use Drydock's builtin EC2 Blueprints, configure your AWS
	// EC2 credentials here.
	'amazon-ec2.access-key' => null,
	'amazon-ec2.secret-key' => null,


	// -- Customization --------------------------------------------------------- //

	// Paths to additional phutil libraries to load.
	'load-libraries' => array(),

	'aphront.default-application-configuration-class' =>
	'AphrontDefaultApplicationConfiguration',

	- 'controller.oauth-registration' =>
	- 'PhabricatorOAuthDefaultRegistrationController',
	-
	-
	// Directory that phd (the Phabricator daemon control script) should use to
	// track running daemons.
	'phd.pid-directory' => '/var/tmp/phd/pid',

	// Directory that the Phabricator daemons should use to store the log file
	'phd.log-directory' => '/var/tmp/phd/log',

	// Number of "TaskMaster" daemons that "phd start" should start. You can
	// raise this if you have a task backlog, or explicitly launch more with
	// "phd launch <N> taskmaster".
	'phd.start-taskmasters' => 4,

	// Launch daemons in "verbose" mode by default. This creates a lot of output,
	// but can help debug issues. Daemons launched in debug mode with "phd debug"
	// are always launched in verbose mode. See also 'phd.trace'.
	'phd.verbose' => false,

	// Launch daemons in "trace" mode by default. This creates an ENORMOUS amount
	// of output, but can help debug issues. Daemons launched in debug mode with
	// "phd debug" are always launched in trace mdoe. See also 'phd.verbose'.
	'phd.trace' => false,

	// Path to custom celerity resource map relative to 'phabricator/src'.
	// See also `scripts/celerity_mapper.php`.
	'celerity.resource-path' => '__celerity_resource_map__.php',

	// This value is an input to the hash function when building resource hashes.
	// It has no security value, but if you accidentally poison user caches (by
	// pushing a bad patch or having something go wrong with a CDN, e.g.) you can
	// change this to something else and rebuild the Celerity map to break user
	// caches. Unless you are doing Celerity development, it is exceptionally
	// unlikely that you need to modify this.
	'celerity.resource-hash' => 'd9455ea150622ee044f7931dabfa52aa',

	// Minify static resources by removing whitespace and comments. You should
	// enable this in production, but disable it in development.
	'celerity.minify' => false,

	// You can respond to various application events by installing listeners,
	// which will receive callbacks when interesting things occur. Specify a list
	// of classes which extend PhabricatorEventListener here.
	'events.listeners' => array(),

	// -- Syntax Highlighting --------------------------------------------------- //

	// Phabricator can highlight PHP by default and use Pygments for other
	// languages if enabled. You can provide a custom highlighter engine by
	// extending class PhutilSyntaxHighlighterEngine.
	'syntax-highlighter.engine' => 'PhutilDefaultSyntaxHighlighterEngine',

	// If you want syntax highlighting for other languages than PHP then you can
	// install the python package 'Pygments', make sure the 'pygmentize' script is
	// available in the $PATH of the webserver, and then enable this.
	'pygments.enabled' => false,

	// In places that we display a dropdown to syntax-highlight code,
	// this is where that list is defined.
	// Syntax is 'lexer-name' => 'Display Name',
	'pygments.dropdown-choices' => array(
	'apacheconf' => 'Apache Configuration',
	'bash' => 'Bash Scripting',
	'brainfuck' => 'Brainf*ck',
	'c' => 'C',
	'cpp' => 'C++',
	'css' => 'CSS',
	'd' => 'D',
	'diff' => 'Diff',
	'django' => 'Django Templating',
	'erb' => 'Embedded Ruby/ERB',
	'erlang' => 'Erlang',
	'haskell' => 'Haskell',
	'html' => 'HTML',
	'java' => 'Java',
	'js' => 'Javascript',
	'mysql' => 'MySQL',
	'objc' => 'Objective-C',
	'perl' => 'Perl',
	'php' => 'PHP',
	'rest' => 'reStructuredText',
	'text' => 'Plain Text',
	'python' => 'Python',
	'rainbow' => 'Rainbow',
	'remarkup' => 'Remarkup',
	'ruby' => 'Ruby',
	'xml' => 'XML',
	),

	// This is an override list of regular expressions which allows you to choose
	// what language files are highlighted as. If your projects have certain rules
	// about filenames or use unusual or ambiguous language extensions, you can
	// create a mapping here. This is an ordered dictionary of regular expressions
	// which will be tested against the filename. They should map to either an
	// explicit language as a string value, or a numeric index into the captured
	// groups as an integer.
	'syntax.filemap' => array(
	// Example: Treat all '*.xyz' files as PHP.
	// '@\\.xyz$@' => 'php',

	// Example: Treat 'httpd.conf' as 'apacheconf'.
	// '@/httpd\\.conf$@' => 'apacheconf',

	// Example: Treat all '*.x.bak' file as '.x'. NOTE: we map to capturing
	// group 1 by specifying the mapping as "1".
	// '@\\.([^.]+)\\.bak$@' => 1,

	'@\.arcconfig$@' => 'js',
	'@\.divinerconfig$@' => 'js',
	),

	// Set the default monospaced font style for users who haven't set a custom
	// style.
	'style.monospace' => '10px "Menlo", "Consolas", "Monaco", monospace',
	'style.monospace.windows' => '11px "Menlo", "Consolas", "Monaco", monospace',


	// -- Debugging ------------------------------------------------------------- //

	// Enable this to change HTTP redirects into normal pages with a link to the
	// redirection target. For example, after you submit a form you'll get a page
	// saying "normally, you'd be redirected...". This is useful to examine
	// service or profiler information on write pathways, or debug redirects. It
	// also makes the UX horrible for normal use, so you should enable it only
	// when debugging.
	//
	// NOTE: This does not currently work for forms with Javascript "workflow",
	// since the redirect happens in Javascript.
	'debug.stop-on-redirect' => false,

	// Set the rate for how often to do sampled profiling. On average, one
	// request for every number of requests specified here will be sampled.
	// Set this value to 0 to completely disable profiling. In a production
	// environment, this value should either be set to 0 (to disable) or to
	// a large number (to sample only a few requests).
	'debug.profile-rate' => 0,

	// -- Environment ---------------------------------------------------------- //

	// Phabricator occasionally shells out to other binaries on the server.
	// An example of this is the "pygmentize" command, used to syntax-highlight
	// code written in languages other than PHP. By default, it is assumed that
	// these binaries are in the $PATH of the user running Phabricator (normally
	// 'apache', 'httpd', or 'nobody'). Here you can add extra directories to
	// the $PATH environment variable, for when these binaries are in non-standard
	// locations.
	'environment.append-paths' => array(),

	// -- Audit ---------------------------------------------------------- //

	// Controls whether or not task creator can Close Audits
	'audit.can-author-close-audit' => false,
	);
	diff --git a/src/applications/auth/application/PhabricatorApplicationAuth.php b/src/applications/auth/application/PhabricatorApplicationAuth.php
	index 26c1bf3c2a..4b11931926 100644
	--- a/src/applications/auth/application/PhabricatorApplicationAuth.php
	+++ b/src/applications/auth/application/PhabricatorApplicationAuth.php
	@@ -1,76 +1,88 @@
	<?php

	final class PhabricatorApplicationAuth extends PhabricatorApplication {

	public function canUninstall() {
	return false;
	}

	public function getBaseURI() {
	return '/auth/';
	}

	public function getIconName() {
	return 'authentication';
	}

	+ public function getHelpURI() {
	+ // NOTE: Although reasonable help exists for this in "Configuring Accounts
	+ // and Registration", specifying a help URI here means we get the menu
	+ // item in all the login/link interfaces, which is confusing and not
	+ // helpful.
	+
	+ // TODO: Special case this, or split the auth and auth administration
	+ // applications?
	+
	+ return null;
	+ }
	+
	public function buildMainMenuItems(
	PhabricatorUser $user,
	PhabricatorController $controller = null) {

	$items = array();

	if ($user->isLoggedIn()) {
	$item = id(new PHUIListItemView())
	->addClass('core-menu-item')
	->setName(pht('Log Out'))
	->setIcon('power')
	->setWorkflow(true)
	->setHref('/logout/')
	->setSelected(($controller instanceof PhabricatorLogoutController));
	$items[] = $item;
	}

	return $items;
	}

	public function getApplicationGroup() {
	return self::GROUP_ADMIN;
	}

	public function getRoutes() {
	return array(
	'/auth/' => array(
	'' => 'PhabricatorAuthListController',
	'config/' => array(
	'new/' => 'PhabricatorAuthNewController',
	'new/(?P<className>[^/]+)/' => 'PhabricatorAuthEditController',
	'edit/(?P<id>\d+)/' => 'PhabricatorAuthEditController',
	'(?P<action>enable\|disable)/(?P<id>\d+)/' =>
	'PhabricatorAuthDisableController',
	),
	'login/(?P<pkey>[^/]+)/' => 'PhabricatorAuthLoginController',
	'register/(?:(?P<akey>[^/]+)/)?' => 'PhabricatorAuthRegisterController',
	'start/' => 'PhabricatorAuthStartController',
	'validate/' => 'PhabricatorAuthValidateController',
	'unlink/(?P<pkey>[^/]+)/' => 'PhabricatorAuthUnlinkController',
	'link/(?P<pkey>[^/]+)/' => 'PhabricatorAuthLinkController',
	'confirmlink/(?P<akey>[^/]+)/'
	=> 'PhabricatorAuthConfirmLinkController',
	),

	'/oauth/google/login/' => 'PhabricatorAuthOldOAuthRedirectController',

	'/login/' => array(
	'' => 'PhabricatorAuthStartController',
	'email/' => 'PhabricatorEmailLoginController',
	'etoken/(?P<token>\w+)/' => 'PhabricatorEmailTokenController',
	'refresh/' => 'PhabricatorRefreshCSRFController',
	'mustverify/' => 'PhabricatorMustVerifyEmailController',
	),

	'/logout/' => 'PhabricatorLogoutController',
	);
	}

	}
	diff --git a/src/applications/auth/controller/PhabricatorEmailLoginController.php b/src/applications/auth/controller/PhabricatorEmailLoginController.php
	index 3875de3c62..d1726e57f4 100644
	--- a/src/applications/auth/controller/PhabricatorEmailLoginController.php
	+++ b/src/applications/auth/controller/PhabricatorEmailLoginController.php
	@@ -1,157 +1,157 @@
	<?php

	final class PhabricatorEmailLoginController
	extends PhabricatorAuthController {

	public function shouldRequireLogin() {
	return false;
	}

	public function processRequest() {
	$request = $this->getRequest();

	- if (!PhabricatorEnv::getEnvConfig('auth.password-auth-enabled')) {
	+ if (!PhabricatorAuthProviderPassword::getPasswordProvider()) {
	return new Aphront400Response();
	}

	$e_email = true;
	$e_captcha = true;
	$errors = array();

	$is_serious = PhabricatorEnv::getEnvConfig('phabricator.serious-business');

	if ($request->isFormPost()) {
	$e_email = null;
	$e_captcha = pht('Again');

	$captcha_ok = AphrontFormRecaptchaControl::processCaptcha($request);
	if (!$captcha_ok) {
	$errors[] = pht("Captcha response is incorrect, try again.");
	$e_captcha = pht('Invalid');
	}

	$email = $request->getStr('email');
	if (!strlen($email)) {
	$errors[] = pht("You must provide an email address.");
	$e_email = pht('Required');
	}

	if (!$errors) {
	// NOTE: Don't validate the email unless the captcha is good; this makes
	// it expensive to fish for valid email addresses while giving the user
	// a better error if they goof their email.

	$target_email = id(new PhabricatorUserEmail())->loadOneWhere(
	'address = %s',
	$email);

	$target_user = null;
	if ($target_email) {
	$target_user = id(new PhabricatorUser())->loadOneWhere(
	'phid = %s',
	$target_email->getUserPHID());
	}

	if (!$target_user) {
	$errors[] =
	pht("There is no account associated with that email address.");
	$e_email = pht("Invalid");
	}

	if (!$errors) {
	$uri = $target_user->getEmailLoginURI($target_email);
	if ($is_serious) {
	$body = <<<EOBODY
	You can use this link to reset your Phabricator password:

	{$uri}

	EOBODY;
	} else {
	$body = <<<EOBODY
	Condolences on forgetting your password. You can use this link to reset it:

	{$uri}

	After you set a new password, consider writing it down on a sticky note and
	attaching it to your monitor so you don't forget again! Choosing a very short,
	easy-to-remember password like "cat" or "1234" might also help.

	Best Wishes,
	Phabricator

	EOBODY;
	}

	// NOTE: Don't set the user as 'from', or they may not receive the
	// mail if they have the "don't send me email about my own actions"
	// preference set.

	$mail = new PhabricatorMetaMTAMail();
	$mail->setSubject('[Phabricator] Password Reset');
	$mail->addTos(
	array(
	$target_user->getPHID(),
	));
	$mail->setBody($body);
	$mail->saveAndSend();

	$view = new AphrontRequestFailureView();
	$view->setHeader(pht('Check Your Email'));
	$view->appendChild(phutil_tag('p', array(), pht(
	'An email has been sent with a link you can use to login.')));
	return $this->buildStandardPageResponse(
	$view,
	array(
	'title' => pht('Email Sent'),
	));
	}
	}

	}

	$email_auth = new AphrontFormView();
	$email_auth
	->setAction('/login/email/')
	->setUser($request->getUser())
	->appendChild(
	id(new AphrontFormTextControl())
	->setLabel(pht('Email'))
	->setName('email')
	->setValue($request->getStr('email'))
	->setError($e_email))
	->appendChild(
	id(new AphrontFormRecaptchaControl())
	->setLabel(pht('Captcha'))
	->setError($e_captcha))
	->appendChild(
	id(new AphrontFormSubmitControl())
	->setValue(pht('Send Email')));

	$error_view = null;
	if ($errors) {
	$error_view = new AphrontErrorView();
	$error_view->setTitle(pht('Login Error'));
	$error_view->setErrors($errors);
	}


	$panel = new AphrontPanelView();
	$panel->setWidth(AphrontPanelView::WIDTH_FORM);
	$panel->appendChild(phutil_tag('h1', array(), pht(
	'Forgot Password / Email Login')));
	$panel->appendChild($email_auth);
	$panel->setNoBackground();

	return $this->buildApplicationPage(
	array(
	$error_view,
	$panel,
	),
	array(
	'title' => pht('Forgot Password'),
	'device' => true,
	));
	}

	}
	diff --git a/src/applications/auth/controller/PhabricatorEmailTokenController.php b/src/applications/auth/controller/PhabricatorEmailTokenController.php
	index 2f8d51f061..e907a7dcb4 100644
	--- a/src/applications/auth/controller/PhabricatorEmailTokenController.php
	+++ b/src/applications/auth/controller/PhabricatorEmailTokenController.php
	@@ -1,92 +1,92 @@
	<?php

	final class PhabricatorEmailTokenController
	extends PhabricatorAuthController {

	private $token;

	public function shouldRequireLogin() {
	return false;
	}

	public function willProcessRequest(array $data) {
	$this->token = $data['token'];
	}

	public function processRequest() {
	$request = $this->getRequest();

	$token = $this->token;
	$email = $request->getStr('email');

	// NOTE: We need to bind verification to addresses, not users,
	// because we verify addresses when they're used to login this way, and if
	// we have a user-based verification you can:
	//
	// - Add some address you do not own;
	// - request a password reset;
	// - change the URI in the email to the address you don't own;
	// - login via the email link; and
	// - get a "verified" address you don't control.

	$target_email = id(new PhabricatorUserEmail())->loadOneWhere(
	'address = %s',
	$email);

	$target_user = null;
	if ($target_email) {
	$target_user = id(new PhabricatorUser())->loadOneWhere(
	'phid = %s',
	$target_email->getUserPHID());
	}

	if (!$target_email \|\|
	!$target_user \|\|
	!$target_user->validateEmailToken($target_email, $token)) {

	$view = new AphrontRequestFailureView();
	$view->setHeader(pht('Unable to Login'));
	$view->appendChild(phutil_tag('p', array(), pht(
	'The authentication information in the link you clicked is '.
	'invalid or out of date. Make sure you are copy-and-pasting the '.
	'entire link into your browser. You can try again, or request '.
	'a new email.')));
	$view->appendChild(hsprintf(
	'<div class="aphront-failure-continue">'.
	'<a class="button" href="/login/email/">%s</a>'.
	'</div>',
	pht('Send Another Email')));

	return $this->buildStandardPageResponse(
	$view,
	array(
	'title' => pht('Login Failure'),
	));
	}

	// Verify email so that clicking the link in the "Welcome" email is good
	// enough, without requiring users to go through a second round of email
	// verification.

	$unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
	$target_email->setIsVerified(1);
	$target_email->save();
	unset($unguarded);

	$next = '/';
	- if (!PhabricatorEnv::getEnvConfig('auth.password-auth-enabled')) {
	+ if (!PhabricatorAuthProviderPassword::getPasswordProvider()) {
	$next = '/settings/panel/external/';
	} else if (PhabricatorEnv::getEnvConfig('account.editable')) {
	$next = (string)id(new PhutilURI('/settings/panel/password/'))
	->setQueryParams(
	array(
	'token' => $token,
	'email' => $email,
	));
	}

	$request->setCookie('next_uri', $next);

	return $this->loginUser($target_user);
	}
	}
	diff --git a/src/applications/auth/controller/config/PhabricatorAuthEditController.php b/src/applications/auth/controller/config/PhabricatorAuthEditController.php
	index 1f50db00aa..edc9f529aa 100644
	--- a/src/applications/auth/controller/config/PhabricatorAuthEditController.php
	+++ b/src/applications/auth/controller/config/PhabricatorAuthEditController.php
	@@ -1,262 +1,268 @@
	<?php

	final class PhabricatorAuthEditController
	extends PhabricatorAuthProviderConfigController {

	private $providerClass;
	private $configID;

	public function willProcessRequest(array $data) {
	$this->providerClass = idx($data, 'className');
	$this->configID = idx($data, 'id');
	}

	public function processRequest() {
	$request = $this->getRequest();
	$viewer = $request->getUser();

	if ($this->configID) {
	$config = id(new PhabricatorAuthProviderConfigQuery())
	->setViewer($viewer)
	->requireCapabilities(
	array(
	PhabricatorPolicyCapability::CAN_VIEW,
	PhabricatorPolicyCapability::CAN_EDIT,
	))
	->withIDs(array($this->configID))
	->executeOne();
	if (!$config) {
	return new Aphront404Response();
	}

	$provider = $config->getProvider();
	if (!$provider) {
	return new Aphront404Response();
	}

	$is_new = false;
	} else {
	$providers = PhabricatorAuthProvider::getAllBaseProviders();
	foreach ($providers as $candidate_provider) {
	if (get_class($candidate_provider) === $this->providerClass) {
	$provider = $candidate_provider;
	break;
	}
	}

	if (!$provider) {
	return new Aphront404Response();
	}

	// TODO: When we have multi-auth providers, support them here.

	$configs = id(new PhabricatorAuthProviderConfigQuery())
	->setViewer($viewer)
	->withProviderClasses(array(get_class($provider)))
	->execute();

	if ($configs) {
	// TODO: We could link to the other config's edit interface here.
	throw new Exception("This provider is already configured!");
	}

	$config = $provider->getDefaultProviderConfig();
	$provider->attachProviderConfig($config);

	$is_new = true;
	}

	$errors = array();

	$v_registration = $config->getShouldAllowRegistration();
	$v_link = $config->getShouldAllowLink();
	$v_unlink = $config->getShouldAllowUnlink();

	if ($request->isFormPost()) {

	$properties = $provider->readFormValuesFromRequest($request);
	list($errors, $issues, $properties) = $provider->processEditForm(
	$request,
	$properties);

	$xactions = array();

	if (!$errors) {
	if ($is_new) {
	$config->setProviderType($provider->getProviderType());
	$config->setProviderDomain($provider->getProviderDomain());
	}

	$xactions[] = id(new PhabricatorAuthProviderConfigTransaction())
	->setTransactionType(
	PhabricatorAuthProviderConfigTransaction::TYPE_REGISTRATION)
	->setNewValue($request->getInt('allowRegistration', 0));

	$xactions[] = id(new PhabricatorAuthProviderConfigTransaction())
	->setTransactionType(
	PhabricatorAuthProviderConfigTransaction::TYPE_LINK)
	->setNewValue($request->getInt('allowLink', 0));

	$xactions[] = id(new PhabricatorAuthProviderConfigTransaction())
	->setTransactionType(
	PhabricatorAuthProviderConfigTransaction::TYPE_UNLINK)
	->setNewValue($request->getInt('allowUnlink', 0));

	foreach ($properties as $key => $value) {
	$xactions[] = id(new PhabricatorAuthProviderConfigTransaction())
	->setTransactionType(
	PhabricatorAuthProviderConfigTransaction::TYPE_PROPERTY)
	->setMetadataValue('auth:property', $key)
	->setNewValue($value);
	}

	$editor = id(new PhabricatorAuthProviderConfigEditor())
	->setActor($viewer)
	->setContentSourceFromRequest($request)
	->setContinueOnNoEffect(true)
	->applyTransactions($config, $xactions);

	return id(new AphrontRedirectResponse())->setURI(
	$this->getApplicationURI());
	}
	} else {
	$properties = $provider->readFormValuesFromProvider();
	$issues = array();
	}

	if ($errors) {
	$errors = id(new AphrontErrorView())->setErrors($errors);
	}

	if ($is_new) {
	$button = pht('Add Provider');
	$crumb = pht('Add Provider');
	$title = pht('Add Authentication Provider');
	$cancel_uri = $this->getApplicationURI('/config/new/');
	} else {
	$button = pht('Save');
	$crumb = pht('Edit Provider');
	$title = pht('Edit Authentication Provider');
	$cancel_uri = $this->getApplicationURI();
	}

	$str_registration = hsprintf(
	'<strong>%s:</strong> %s',
	pht('Allow Registration'),
	pht(
	'Allow users to register new Phabricator accounts using this '.
	'provider. If you disable registration, users can still use this '.
	'provider to log in to existing accounts, but will not be able to '.
	'create new accounts.'));

	$str_link = hsprintf(
	'<strong>%s:</strong> %s',
	pht('Allow Linking Accounts'),
	pht(
	'Allow users to link account credentials for this provider to '.
	'existing Phabricator accounts. There is normally no reason to '.
	'disable this unless you are trying to move away from a provider '.
	'and want to stop users from creating new account links.'));

	$str_unlink = hsprintf(
	'<strong>%s:</strong> %s',
	pht('Allow Unlinking Accounts'),
	pht(
	'Allow users to unlink account credentials for this provider from '.
	'existing Phabricator accounts. If you disable this, Phabricator '.
	'accounts will be permanently bound to provider accounts.'));

	$status_tag = id(new PhabricatorTagView())
	->setType(PhabricatorTagView::TYPE_STATE);
	if ($is_new) {
	$status_tag
	->setName(pht('New Provider'))
	->setBackgroundColor('blue');
	} else if ($config->getIsEnabled()) {
	$status_tag
	->setName(pht('Enabled'))
	->setBackgroundColor('green');
	} else {
	$status_tag
	->setName(pht('Disabled'))
	->setBackgroundColor('red');
	}

	$form = id(new AphrontFormView())
	->setUser($viewer)
	->setFlexible(true)
	->appendChild(
	id(new AphrontFormStaticControl())
	->setLabel(pht('Provider'))
	->setValue($provider->getProviderName()))
	->appendChild(
	id(new AphrontFormStaticControl())
	->setLabel(pht('Status'))
	->setValue($status_tag))
	->appendChild(
	id(new AphrontFormCheckboxControl())
	->setLabel(pht('Allow'))
	->addCheckbox(
	'allowRegistration',
	1,
	$str_registration,
	$v_registration))
	->appendChild(
	id(new AphrontFormCheckboxControl())
	->addCheckbox(
	'allowLink',
	1,
	$str_link,
	$v_link))
	->appendChild(
	id(new AphrontFormCheckboxControl())
	->addCheckbox(
	'allowUnlink',
	1,
	$str_unlink,
	$v_unlink));

	$provider->extendEditForm($request, $form, $properties, $issues);

	$form
	->appendChild(
	id(new AphrontFormSubmitControl())
	->addCancelButton($cancel_uri)
	->setValue($button));

	+ $help = $provider->getConfigurationHelp();
	+ if ($help) {
	+ $form->appendChild(id(new PHUIFormDividerControl()));
	+ $form->appendRemarkupInstructions($help);
	+ }
	+
	$crumbs = $this->buildApplicationCrumbs();
	$crumbs->addCrumb(
	id(new PhabricatorCrumbView())
	->setName($crumb));

	$xaction_view = null;
	if (!$is_new) {
	$xactions = id(new PhabricatorAuthProviderConfigTransactionQuery())
	->withObjectPHIDs(array($config->getPHID()))
	->setViewer($viewer)
	->execute();

	foreach ($xactions as $xaction) {
	$xaction->setProvider($provider);
	}

	$xaction_view = id(new PhabricatorApplicationTransactionView())
	->setUser($viewer)
	->setTransactions($xactions);
	}

	return $this->buildApplicationPage(
	array(
	$crumbs,
	$errors,
	$form,
	$xaction_view,
	),
	array(
	'title' => $title,
	'dust' => true,
	'device' => true,
	));
	}

	}
	diff --git a/src/applications/auth/provider/PhabricatorAuthProvider.php b/src/applications/auth/provider/PhabricatorAuthProvider.php
	index 68b0912389..faa878d4a8 100644
	--- a/src/applications/auth/provider/PhabricatorAuthProvider.php
	+++ b/src/applications/auth/provider/PhabricatorAuthProvider.php
	@@ -1,319 +1,323 @@
	<?php

	abstract class PhabricatorAuthProvider {

	private $providerConfig;

	public function attachProviderConfig(PhabricatorAuthProviderConfig $config) {
	$this->providerConfig = $config;
	return $this;
	}

	public function hasProviderConfig() {
	return (bool)$this->providerConfig;
	}

	public function getProviderConfig() {
	if ($this->providerConfig === null) {
	throw new Exception(
	"Call attachProviderConfig() before getProviderConfig()!");
	}
	return $this->providerConfig;
	}

	+ public function getConfigurationHelp() {
	+ return null;
	+ }
	+
	public function getDefaultProviderConfig() {
	return id(new PhabricatorAuthProviderConfig())
	->setProviderClass(get_class($this))
	->setIsEnabled(1)
	->setShouldAllowLogin(1)
	->setShouldAllowRegistration(1)
	->setShouldAllowLink(1)
	->setShouldAllowUnlink(1);
	}

	public function getNameForCreate() {
	return $this->getProviderName();
	}

	public function getDescriptionForCreate() {
	return null;
	}

	public function getProviderKey() {
	return $this->getAdapter()->getAdapterKey();
	}

	public function getProviderType() {
	return $this->getAdapter()->getAdapterType();
	}

	public function getProviderDomain() {
	return $this->getAdapter()->getAdapterDomain();
	}

	public static function getAllBaseProviders() {
	static $providers;

	if ($providers === null) {
	$objects = id(new PhutilSymbolLoader())
	->setAncestorClass(__CLASS__)
	->loadObjects();
	$providers = $objects;
	}

	return $providers;
	}

	public static function getAllProviders() {
	static $providers;

	if ($providers === null) {
	$objects = self::getAllBaseProviders();

	$configs = id(new PhabricatorAuthProviderConfigQuery())
	->setViewer(PhabricatorUser::getOmnipotentUser())
	->execute();

	$providers = array();
	foreach ($configs as $config) {
	if (!isset($objects[$config->getProviderClass()])) {
	// This configuration is for a provider which is not installed.
	continue;
	}

	$object = clone $objects[$config->getProviderClass()];
	$object->attachProviderConfig($config);

	$key = $object->getProviderKey();
	if (isset($providers[$key])) {
	throw new Exception(
	pht(
	"Two authentication providers use the same provider key ".
	"('%s'). Each provider must be identified by a unique ".
	"key.",
	$key));
	}
	$providers[$key] = $object;
	}
	}

	return $providers;
	}

	public static function getAllEnabledProviders() {
	$providers = self::getAllProviders();
	foreach ($providers as $key => $provider) {
	if (!$provider->isEnabled()) {
	unset($providers[$key]);
	}
	}
	return $providers;
	}

	public static function getEnabledProviderByKey($provider_key) {
	return idx(self::getAllEnabledProviders(), $provider_key);
	}

	abstract public function getProviderName();
	abstract public function getAdapter();

	public function isEnabled() {
	return $this->getProviderConfig()->getIsEnabled();
	}

	public function shouldAllowLogin() {
	return $this->getProviderConfig()->getShouldAllowLogin();
	}

	public function shouldAllowRegistration() {
	return $this->getProviderConfig()->getShouldAllowRegistration();
	}

	public function shouldAllowAccountLink() {
	return $this->getProviderConfig()->getShouldAllowLink();
	}

	public function shouldAllowAccountUnlink() {
	return $this->getProviderConfig()->getShouldAllowUnlink();
	}

	public function buildLoginForm(
	PhabricatorAuthStartController $controller) {
	return $this->renderLoginForm($controller->getRequest(), $mode = 'start');
	}

	abstract public function processLoginRequest(
	PhabricatorAuthLoginController $controller);

	public function buildLinkForm(
	PhabricatorAuthLinkController $controller) {
	return $this->renderLoginForm($controller->getRequest(), $mode = 'link');
	}

	protected function renderLoginForm(
	AphrontRequest $request,
	$mode) {
	throw new Exception("Not implemented!");
	}

	public function createProviders() {
	return array($this);
	}

	protected function willSaveAccount(PhabricatorExternalAccount $account) {
	return;
	}

	public function willRegisterAccount(PhabricatorExternalAccount $account) {
	return;
	}

	protected function loadOrCreateAccount($account_id) {
	if (!strlen($account_id)) {
	throw new Exception(
	"loadOrCreateAccount(...): empty account ID!");
	}

	$adapter = $this->getAdapter();
	$adapter_class = get_class($adapter);

	if (!strlen($adapter->getAdapterType())) {
	throw new Exception(
	"AuthAdapter (of class '{$adapter_class}') has an invalid ".
	"implementation: no adapter type.");
	}

	if (!strlen($adapter->getAdapterDomain())) {
	throw new Exception(
	"AuthAdapter (of class '{$adapter_class}') has an invalid ".
	"implementation: no adapter domain.");
	}

	$account = id(new PhabricatorExternalAccount())->loadOneWhere(
	'accountType = %s AND accountDomain = %s AND accountID = %s',
	$adapter->getAdapterType(),
	$adapter->getAdapterDomain(),
	$account_id);
	if (!$account) {
	$account = id(new PhabricatorExternalAccount())
	->setAccountType($adapter->getAdapterType())
	->setAccountDomain($adapter->getAdapterDomain())
	->setAccountID($account_id);
	}

	$account->setUsername($adapter->getAccountName());
	$account->setRealName($adapter->getAccountRealName());
	$account->setEmail($adapter->getAccountEmail());
	$account->setAccountURI($adapter->getAccountURI());

	$account->setProfileImagePHID(null);
	$image_uri = $adapter->getAccountImageURI();
	if ($image_uri) {
	try {
	$name = PhabricatorSlug::normalize($this->getProviderName());
	$name = $name.'-profile.jpg';

	// TODO: If the image has not changed, we do not need to make a new
	// file entry for it, but there's no convenient way to do this with
	// PhabricatorFile right now. The storage will get shared, so the impact
	// here is negligible.
	$unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
	$image_file = PhabricatorFile::newFromFileDownload(
	$image_uri,
	array(
	'name' => $name,
	));
	unset($unguarded);

	if ($image_file) {
	$account->setProfileImagePHID($image_file->getPHID());
	}
	} catch (Exception $ex) {
	// Log this but proceed, it's not especially important that we
	// be able to pull profile images.
	phlog($ex);
	}
	}

	$this->willSaveAccount($account);

	$unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
	$account->save();
	unset($unguarded);

	return $account;
	}

	public function getLoginURI() {
	$app = PhabricatorApplication::getByClass('PhabricatorApplicationAuth');
	$uri = $app->getApplicationURI('/login/'.$this->getProviderKey().'/');
	return PhabricatorEnv::getURI($uri);
	}

	public function getSettingsURI() {
	return '/settings/panel/external/';
	}

	public function getStartURI() {
	$app = PhabricatorApplication::getByClass('PhabricatorApplicationAuth');
	$uri = $app->getApplicationURI('/start/');
	return $uri;
	}

	public function isDefaultRegistrationProvider() {
	return false;
	}

	public function shouldRequireRegistrationPassword() {
	return false;
	}

	public function getDefaultExternalAccount() {
	throw new Exception("Not implemented!");
	}

	public function getLoginOrder() {
	return '500-'.$this->getProviderName();
	}

	protected function getLoginIcon() {
	return 'Generic';
	}

	public function isLoginFormAButton() {
	return false;
	}

	public function renderConfigPropertyTransactionTitle(
	PhabricatorAuthProviderConfigTransaction $xaction) {

	return null;
	}

	public function readFormValuesFromProvider() {
	return array();
	}

	public function readFormValuesFromRequest(AphrontRequest $request) {
	return array();
	}

	public function processEditForm(
	AphrontRequest $request,
	array $values) {

	$errors = array();
	$issues = array();

	return array($errors, $issues, $values);
	}

	public function extendEditForm(
	AphrontRequest $request,
	AphrontFormView $form,
	array $values,
	array $issues) {
	return;
	}

	}
	diff --git a/src/applications/auth/provider/PhabricatorAuthProviderOAuthDisqus.php b/src/applications/auth/provider/PhabricatorAuthProviderOAuthDisqus.php
	index acc039d832..4c374be64c 100644
	--- a/src/applications/auth/provider/PhabricatorAuthProviderOAuthDisqus.php
	+++ b/src/applications/auth/provider/PhabricatorAuthProviderOAuthDisqus.php
	@@ -1,18 +1,36 @@
	<?php

	final class PhabricatorAuthProviderOAuthDisqus
	extends PhabricatorAuthProviderOAuth {

	public function getProviderName() {
	return pht('Disqus');
	}

	+ public function getConfigurationHelp() {
	+ $login_uri = $this->getLoginURI();
	+
	+ return pht(
	+ "To configure Disqus OAuth, create a new application here:".
	+ "\n\n".
	+ "http://disqus.com/api/applications/".
	+ "\n\n".
	+ "Create an application, then adjust these settings:".
	+ "\n\n".
	+ " - Callback URL: Set this to `%s`".
	+ "\n\n".
	+ "After creating an application, copy the Public Key and ".
	+ "Secret Key to the fields above (the Public Key goes in ".
	+ "OAuth App ID).",
	+ $login_uri);
	+ }
	+
	protected function newOAuthAdapter() {
	return new PhutilAuthAdapterOAuthDisqus();
	}

	protected function getLoginIcon() {
	return 'Disqus';
	}

	}
	diff --git a/src/applications/auth/provider/PhabricatorAuthProviderOAuthFacebook.php b/src/applications/auth/provider/PhabricatorAuthProviderOAuthFacebook.php
	index eeb25ed5d6..6c3b91f286 100644
	--- a/src/applications/auth/provider/PhabricatorAuthProviderOAuthFacebook.php
	+++ b/src/applications/auth/provider/PhabricatorAuthProviderOAuthFacebook.php
	@@ -1,109 +1,128 @@
	<?php

	final class PhabricatorAuthProviderOAuthFacebook
	extends PhabricatorAuthProviderOAuth {

	const KEY_REQUIRE_SECURE = 'oauth:facebook:require-secure';

	public function getProviderName() {
	return pht('Facebook');
	}

	+ public function getConfigurationHelp() {
	+ $uri = new PhutilURI(PhabricatorEnv::getProductionURI('/'));
	+ return pht(
	+ 'To configure Facebook OAuth, create a new Facebook Application here:'.
	+ "\n\n".
	+ 'https://developers.facebook.com/apps'.
	+ "\n\n".
	+ 'You should use these settings in your application:'.
	+ "\n\n".
	+ " - Site URL: Set this to your full domain with protocol. For ".
	+ " this Phabricator install, the correct value is: `%s`\n".
	+ " - Site Domain: Set this to the full domain without a protocol. ".
	+ " For this Phabricator install, the correct value is: `%s`\n\n".
	+ "After creating your new application, copy the App ID and ".
	+ "App Secret to the fields above.",
	+ (string)$uri,
	+ $uri->getDomain());
	+ }
	+
	public function getDefaultProviderConfig() {
	return parent::getDefaultProviderConfig()
	->setProperty(self::KEY_REQUIRE_SECURE, 1);
	}

	protected function newOAuthAdapter() {
	$require_secure = $this->getProviderConfig()->getProperty(
	self::KEY_REQUIRE_SECURE);

	return id(new PhutilAuthAdapterOAuthFacebook())
	->setRequireSecureBrowsing($require_secure);
	}

	protected function getLoginIcon() {
	return 'Facebook';
	}

	public function readFormValuesFromProvider() {
	$require_secure = $this->getProviderConfig()->getProperty(
	self::KEY_REQUIRE_SECURE);

	return parent::readFormValuesFromProvider() + array(
	self::KEY_REQUIRE_SECURE => $require_secure,
	);
	}

	public function readFormValuesFromRequest(AphrontRequest $request) {
	return parent::readFormValuesFromRequest($request) + array(
	self::KEY_REQUIRE_SECURE => $request->getBool(self::KEY_REQUIRE_SECURE),
	);
	}

	public function extendEditForm(
	AphrontRequest $request,
	AphrontFormView $form,
	array $values,
	array $issues) {

	parent::extendEditForm($request, $form, $values, $issues);

	$key_require = self::KEY_REQUIRE_SECURE;
	$v_require = idx($values, $key_require);

	$form
	->appendChild(
	id(new AphrontFormCheckboxControl())
	->addCheckbox(
	$key_require,
	$v_require,
	pht(
	"%s ".
	"Require users to enable 'secure browsing' on Facebook in order ".
	"to use Facebook to authenticate with Phabricator. This ".
	"improves security by preventing an attacker from capturing ".
	"an insecure Facebook session and escalating it into a ".
	"Phabricator session. Enabling it is recommended.",
	hsprintf(
	'<strong>%s</strong>',
	pht('Require Secure Browsing:')))));
	}

	public function renderConfigPropertyTransactionTitle(
	PhabricatorAuthProviderConfigTransaction $xaction) {

	$author_phid = $xaction->getAuthorPHID();
	$old = $xaction->getOldValue();
	$new = $xaction->getNewValue();
	$key = $xaction->getMetadataValue(
	PhabricatorAuthProviderConfigTransaction::PROPERTY_KEY);

	switch ($key) {
	case self::KEY_REQUIRE_SECURE:
	if ($new) {
	return pht(
	'%s turned "Require Secure Browsing" on.',
	$xaction->renderHandleLink($author_phid));
	} else {
	return pht(
	'%s turned "Require Secure Browsing" off.',
	$xaction->renderHandleLink($author_phid));
	}
	}

	return parent::renderConfigPropertyTransactionTitle($xaction);
	}

	public static function getFacebookApplicationID() {
	$providers = PhabricatorAuthProvider::getAllProviders();
	$fb_provider = idx($providers, 'facebook:facebook.com');
	if (!$fb_provider) {
	return null;
	}

	return $fb_provider->getProperty(
	PhabricatorAuthProviderOAuth::PROPERTY_APP_ID);
	}

	}
	diff --git a/src/applications/auth/provider/PhabricatorAuthProviderOAuthGitHub.php b/src/applications/auth/provider/PhabricatorAuthProviderOAuthGitHub.php
	index f56f202606..c87628f7ec 100644
	--- a/src/applications/auth/provider/PhabricatorAuthProviderOAuthGitHub.php
	+++ b/src/applications/auth/provider/PhabricatorAuthProviderOAuthGitHub.php
	@@ -1,18 +1,39 @@
	<?php

	final class PhabricatorAuthProviderOAuthGitHub
	extends PhabricatorAuthProviderOAuth {

	public function getProviderName() {
	return pht('GitHub');
	}

	+ public function getConfigurationHelp() {
	+ $uri = PhabricatorEnv::getProductionURI('/');
	+ $callback_uri = $this->getLoginURI();
	+
	+ return pht(
	+ "To configure GitHub OAuth, create a new GitHub Application here:".
	+ "\n\n".
	+ "https://github.com/settings/applications/new".
	+ "\n\n".
	+ "You should use these settings in your application:".
	+ "\n\n".
	+ " - URL: Set this to your full domain with protocol. For this ".
	+ " Phabricator install, the correct value is: `%s`\n".
	+ " - Callback URL: Set this to: `%s`\n".
	+ "\n\n".
	+ "Once you've created an application, copy the Client ID and ".
	+ "Client Secret into the fields above.",
	+ $uri,
	+ $callback_uri);
	+ }
	+
	protected function newOAuthAdapter() {
	return new PhutilAuthAdapterOAuthGitHub();
	}

	protected function getLoginIcon() {
	return 'Github';
	}

	}
	diff --git a/src/applications/auth/provider/PhabricatorAuthProviderOAuthGoogle.php b/src/applications/auth/provider/PhabricatorAuthProviderOAuthGoogle.php
	index a20aec5df2..bd10f13afd 100644
	--- a/src/applications/auth/provider/PhabricatorAuthProviderOAuthGoogle.php
	+++ b/src/applications/auth/provider/PhabricatorAuthProviderOAuthGoogle.php
	@@ -1,23 +1,44 @@
	<?php

	final class PhabricatorAuthProviderOAuthGoogle
	extends PhabricatorAuthProviderOAuth {

	public function getProviderName() {
	return pht('Google');
	}

	+ public function getConfigurationHelp() {
	+ $login_uri = $this->getLoginURI();
	+
	+ return pht(
	+ "To configure Google OAuth, create a new 'API Project' here:".
	+ "\n\n".
	+ "https://code.google.com/apis/console/".
	+ "\n\n".
	+ "You don't need to enable any Services, just go to API Access, ".
	+ "click Create an OAuth 2.0 client ID..., and configure these ".
	+ "settings:".
	+ "\n\n".
	+ " - During initial setup click More Options (or after creating ".
	+ " the client ID, click Edit Settings...), then add this to ".
	+ " Authorized Redirect URIs: `%s`\n".
	+ "\n\n".
	+ "After completing configuration, copy the Client ID and ".
	+ "Client Secret to the fields above.",
	+ $login_uri);
	+ }
	+
	protected function newOAuthAdapter() {
	return new PhutilAuthAdapterOAuthGoogle();
	}

	protected function getLoginIcon() {
	return 'Google';
	}

	public function getLoginURI() {
	// TODO: Clean this up. See PhabricatorAuthOldOAuthRedirectController.
	return PhabricatorEnv::getURI('/oauth/google/login/');
	}

	}
	diff --git a/src/applications/auth/provider/PhabricatorAuthProviderPassword.php b/src/applications/auth/provider/PhabricatorAuthProviderPassword.php
	index 3f315f676c..049c56d29e 100644
	--- a/src/applications/auth/provider/PhabricatorAuthProviderPassword.php
	+++ b/src/applications/auth/provider/PhabricatorAuthProviderPassword.php
	@@ -1,230 +1,248 @@
	<?php

	final class PhabricatorAuthProviderPassword
	extends PhabricatorAuthProvider {

	private $adapter;

	public function getProviderName() {
	return pht('Username/Password');
	}

	+ public function getConfigurationHelp() {
	+ return pht(
	+ 'You can select a minimum password length by setting '.
	+ '`account.minimum-password-length` in configuration.');
	+ }
	+
	public function getDescriptionForCreate() {
	return pht(
	'Allow users to login or register using a username and password.');
	}

	public function getAdapter() {
	if (!$this->adapter) {
	$adapter = new PhutilAuthAdapterEmpty();
	$adapter->setAdapterType('password');
	$adapter->setAdapterDomain('self');
	$this->adapter = $adapter;
	}
	return $this->adapter;
	}

	public function getLoginOrder() {
	// Make sure username/password appears first if it is enabled.
	return '100-'.$this->getProviderName();
	}

	public function shouldAllowRegistration() {
	// TODO: Hard code this as "false" for now so we don't inadvertantly open
	// up password registration where it did not previously exist.
	return false;
	}

	public function shouldAllowAccountLink() {
	return false;
	}

	public function shouldAllowAccountUnlink() {
	return false;
	}

	public function isDefaultRegistrationProvider() {
	return true;
	}

	public function buildLoginForm(
	PhabricatorAuthStartController $controller) {
	$request = $controller->getRequest();
	return $this->renderPasswordLoginForm($request);
	}

	public function buildLinkForm(
	PhabricatorAuthLinkController $controller) {
	throw new Exception("Password providers can't be linked.");
	}

	private function renderPasswordLoginForm(
	AphrontRequest $request,
	$require_captcha = false,
	$captcha_valid = false) {

	$viewer = $request->getUser();

	$dialog = id(new AphrontDialogView())
	->setSubmitURI($this->getLoginURI())
	->setUser($viewer)
	->setTitle(pht('Login to Phabricator'))
	->addSubmitButton(pht('Login'));

	if ($this->shouldAllowRegistration()) {
	$dialog->addCancelButton(
	'/auth/register/',
	pht('Register New Account'));
	}

	$dialog->addFooter(
	phutil_tag(
	'a',
	array(
	'href' => '/login/email/',
	),
	pht('Forgot your password?')));

	$v_user = nonempty(
	$request->getStr('username'),
	$request->getCookie('phusr'));

	$e_user = null;
	$e_pass = null;
	$e_captcha = null;

	$errors = array();
	if ($require_captcha && !$captcha_valid) {
	if (AphrontFormRecaptchaControl::hasCaptchaResponse($request)) {
	$e_captcha = pht('Invalid');
	$errors[] = pht('CAPTCHA was not entered correctly.');
	} else {
	$e_captcha = pht('Required');
	$errors[] = pht('Too many login failures recently. You must '.
	'submit a CAPTCHA with your login request.');
	}
	} else if ($request->isHTTPPost()) {
	// NOTE: This is intentionally vague so as not to disclose whether a
	// given username or email is registered.
	$e_user = pht('Invalid');
	$e_pass = pht('Invalid');
	$errors[] = pht('Username or password are incorrect.');
	}

	if ($errors) {
	$errors = id(new AphrontErrorView())->setErrors($errors);
	}

	$form = id(new AphrontFormLayoutView())
	->setFullWidth(true)
	->appendChild($errors)
	->appendChild(
	id(new AphrontFormTextControl())
	->setLabel('Username or Email')
	->setName('username')
	->setValue($v_user)
	->setError($e_user))
	->appendChild(
	id(new AphrontFormPasswordControl())
	->setLabel('Password')
	->setName('password')
	->setError($e_pass));

	if ($require_captcha) {
	$form->appendChild(
	id(new AphrontFormRecaptchaControl())
	->setError($e_captcha));
	}

	$dialog->appendChild($form);

	return $dialog;
	}

	public function processLoginRequest(
	PhabricatorAuthLoginController $controller) {

	$request = $controller->getRequest();
	$viewer = $request->getUser();

	$require_captcha = false;
	$captcha_valid = false;
	if (AphrontFormRecaptchaControl::isRecaptchaEnabled()) {
	$failed_attempts = PhabricatorUserLog::loadRecentEventsFromThisIP(
	PhabricatorUserLog::ACTION_LOGIN_FAILURE,
	60 * 15);
	if (count($failed_attempts) > 5) {
	$require_captcha = true;
	$captcha_valid = AphrontFormRecaptchaControl::processCaptcha($request);
	}
	}

	$response = null;
	$account = null;
	$log_user = null;

	if (!$require_captcha \|\| $captcha_valid) {
	$username_or_email = $request->getStr('username');
	if (strlen($username_or_email)) {
	$user = id(new PhabricatorUser())->loadOneWhere(
	'username = %s',
	$username_or_email);

	if (!$user) {
	$user = PhabricatorUser::loadOneWithEmailAddress($username_or_email);
	}

	if ($user) {
	$envelope = new PhutilOpaqueEnvelope($request->getStr('password'));
	if ($user->comparePassword($envelope)) {
	$account = $this->loadOrCreateAccount($user->getPHID());
	$log_user = $user;
	}
	}
	}
	}

	if (!$account) {
	$log = PhabricatorUserLog::newLog(
	null,
	$log_user,
	PhabricatorUserLog::ACTION_LOGIN_FAILURE);
	$log->save();

	$request->clearCookie('phusr');
	$request->clearCookie('phsid');

	$response = $controller->buildProviderPageResponse(
	$this,
	$this->renderPasswordLoginForm(
	$request,
	$require_captcha,
	$captcha_valid));
	}

	return array($account, $response);
	}

	public function shouldRequireRegistrationPassword() {
	return true;
	}

	public function getDefaultExternalAccount() {
	$adapter = $this->getAdapter();

	return id(new PhabricatorExternalAccount())
	->setAccountType($adapter->getAdapterType())
	->setAccountDomain($adapter->getAdapterDomain());
	}

	protected function willSaveAccount(PhabricatorExternalAccount $account) {
	parent::willSaveAccount($account);
	$account->setUserPHID($account->getAccountID());
	}

	public function willRegisterAccount(PhabricatorExternalAccount $account) {
	parent::willRegisterAccount($account);
	$account->setAccountID($account->getUserPHID());
	}

	+ public static function getPasswordProvider() {
	+ $providers = self::getAllEnabledProviders();
	+
	+ foreach ($providers as $provider) {
	+ if ($provider instanceof PhabricatorAuthProviderPassword) {
	+ return $provider;
	+ }
	+ }
	+
	+ return null;
	+ }
	+
	}
	diff --git a/src/applications/base/controller/PhabricatorController.php b/src/applications/base/controller/PhabricatorController.php
	index bcfcce63fa..22df5631dc 100644
	--- a/src/applications/base/controller/PhabricatorController.php
	+++ b/src/applications/base/controller/PhabricatorController.php
	@@ -1,330 +1,330 @@
	<?php

	abstract class PhabricatorController extends AphrontController {

	private $handles;

	public function shouldRequireLogin() {

	// If this install is configured to allow public resources and the
	// controller works in public mode, allow the request through.
	$is_public_allowed = PhabricatorEnv::getEnvConfig('policy.allow-public');
	if ($is_public_allowed && $this->shouldAllowPublic()) {
	return false;
	}

	return true;
	}

	public function shouldRequireAdmin() {
	return false;
	}

	public function shouldRequireEnabledUser() {
	return true;
	}

	public function shouldAllowPublic() {
	return false;
	}

	public function shouldRequireEmailVerification() {
	$need_verify = PhabricatorUserEmail::isEmailVerificationRequired();
	$need_login = $this->shouldRequireLogin();

	return ($need_login && $need_verify);
	}

	final public function willBeginExecution() {

	$request = $this->getRequest();

	$user = new PhabricatorUser();

	$phusr = $request->getCookie('phusr');
	$phsid = $request->getCookie('phsid');

	if (strlen($phusr) && $phsid) {
	$info = queryfx_one(
	$user->establishConnection('r'),
	'SELECT u.* FROM %T u JOIN %T s ON u.phid = s.userPHID
	AND s.type LIKE %> AND s.sessionKey = %s',
	$user->getTableName(),
	'phabricator_session',
	'web-',
	PhabricatorHash::digest($phsid));
	if ($info) {
	$user->loadFromArray($info);
	}
	}

	$translation = $user->getTranslation();
	if ($translation &&
	$translation != PhabricatorEnv::getEnvConfig('translation.provider')) {
	$translation = newv($translation, array());
	PhutilTranslator::getInstance()
	->setLanguage($translation->getLanguage())
	->addTranslations($translation->getTranslations());
	}

	$request->setUser($user);

	if ($user->getIsDisabled() && $this->shouldRequireEnabledUser()) {
	$disabled_user_controller = new PhabricatorDisabledUserController(
	$request);
	return $this->delegateToController($disabled_user_controller);
	}

	$event = new PhabricatorEvent(
	PhabricatorEventType::TYPE_CONTROLLER_CHECKREQUEST,
	array(
	'request' => $request,
	'controller' => $this,
	));
	$event->setUser($user);
	PhutilEventEngine::dispatchEvent($event);
	$checker_controller = $event->getValue('controller');
	if ($checker_controller != $this) {
	return $this->delegateToController($checker_controller);
	}

	$preferences = $user->loadPreferences();

	if (PhabricatorEnv::getEnvConfig('darkconsole.enabled')) {
	$dark_console = PhabricatorUserPreferences::PREFERENCE_DARK_CONSOLE;
	if ($preferences->getPreference($dark_console) \|\|
	PhabricatorEnv::getEnvConfig('darkconsole.always-on')) {
	$console = new DarkConsoleCore();
	$request->getApplicationConfiguration()->setConsole($console);
	}
	}

	if ($this->shouldRequireLogin() && !$user->getPHID()) {
	$login_controller = new PhabricatorAuthStartController($request);
	- $login_controller->setCurrentApplication(
	+ $this->setCurrentApplication(
	PhabricatorApplication::getByClass('PhabricatorApplicationAuth'));
	return $this->delegateToController($login_controller);
	}

	if ($this->shouldRequireEmailVerification()) {
	$email = $user->loadPrimaryEmail();
	if (!$email) {
	throw new Exception(
	"No primary email address associated with this account!");
	}
	if (!$email->getIsVerified()) {
	$verify_controller = new PhabricatorMustVerifyEmailController($request);
	return $this->delegateToController($verify_controller);
	}
	}

	if ($this->shouldRequireAdmin() && !$user->getIsAdmin()) {
	return new Aphront403Response();
	}

	}

	public function buildStandardPageView() {
	$view = new PhabricatorStandardPageView();
	$view->setRequest($this->getRequest());
	$view->setController($this);
	return $view;
	}

	public function buildStandardPageResponse($view, array $data) {
	$page = $this->buildStandardPageView();
	$page->appendChild($view);
	$response = new AphrontWebpageResponse();
	$response->setContent($page->render());
	return $response;
	}

	public function getApplicationURI($path = '') {
	if (!$this->getCurrentApplication()) {
	throw new Exception("No application!");
	}
	return $this->getCurrentApplication()->getApplicationURI($path);
	}

	public function buildApplicationPage($view, array $options) {
	$page = $this->buildStandardPageView();

	$title = PhabricatorEnv::getEnvConfig('phabricator.serious-business') ?
	'Phabricator' :
	pht('Bacon Ice Cream for Breakfast');

	$application = $this->getCurrentApplication();
	$page->setTitle(idx($options, 'title', $title));
	if ($application) {
	$page->setApplicationName($application->getName());
	if ($application->getTitleGlyph()) {
	$page->setGlyph($application->getTitleGlyph());
	}
	}

	if (!($view instanceof AphrontSideNavFilterView)) {
	$nav = new AphrontSideNavFilterView();
	$nav->appendChild($view);
	$view = $nav;
	}

	$user = $this->getRequest()->getUser();
	$view->setUser($user);

	$page->appendChild($view);

	$object_phids = idx($options, 'pageObjects', array());
	if ($object_phids) {
	$page->appendPageObjects($object_phids);
	foreach ($object_phids as $object_phid) {
	PhabricatorFeedStoryNotification::updateObjectNotificationViews(
	$user,
	$object_phid);
	}
	}

	if (idx($options, 'device')) {
	$page->setDeviceReady(true);
	}

	$page->setShowChrome(idx($options, 'chrome', true));
	$page->setDust(idx($options, 'dust', false));

	$application_menu = $this->buildApplicationMenu();
	if ($application_menu) {
	$page->setApplicationMenu($application_menu);
	}

	$response = new AphrontWebpageResponse();
	return $response->setContent($page->render());
	}

	public function didProcessRequest($response) {
	$request = $this->getRequest();
	$response->setRequest($request);

	$seen = array();
	while ($response instanceof AphrontProxyResponse) {

	$hash = spl_object_hash($response);
	if (isset($seen[$hash])) {
	$seen[] = get_class($response);
	throw new Exception(
	"Cycle while reducing proxy responses: ".
	implode(' -> ', $seen));
	}
	$seen[$hash] = get_class($response);

	$response = $response->reduceProxyResponse();
	}

	if ($response instanceof AphrontDialogResponse) {
	if (!$request->isAjax()) {
	$view = new PhabricatorStandardPageView();
	$view->setRequest($request);
	$view->setController($this);
	$view->appendChild(hsprintf(
	'<div style="padding: 2em 0;">%s</div>',
	$response->buildResponseString()));
	$view->setDust(true);
	$response = new AphrontWebpageResponse();
	$response->setContent($view->render());
	return $response;
	} else {
	$response->getDialog()->setIsStandalone(true);

	return id(new AphrontAjaxResponse())
	->setContent(array(
	'dialog' => $response->buildResponseString(),
	));
	}
	} else if ($response instanceof AphrontRedirectResponse) {
	if ($request->isAjax()) {
	return id(new AphrontAjaxResponse())
	->setContent(
	array(
	'redirect' => $response->getURI(),
	));
	}
	}
	return $response;
	}

	protected function getHandle($phid) {
	if (empty($this->handles[$phid])) {
	throw new Exception(
	"Attempting to access handle which wasn't loaded: {$phid}");
	}
	return $this->handles[$phid];
	}

	protected function loadHandles(array $phids) {
	$phids = array_filter($phids);
	$this->handles = $this->loadViewerHandles($phids);
	return $this;
	}

	protected function getLoadedHandles() {
	return $this->handles;
	}

	protected function loadViewerHandles(array $phids) {
	return id(new PhabricatorObjectHandleData($phids))
	->setViewer($this->getRequest()->getUser())
	->loadHandles();
	}


	/**
	* Render a list of links to handles, identified by PHIDs. The handles must
	* already be loaded.
	*
	* @param list<phid> List of PHIDs to render links to.
	* @param string Style, one of "\n" (to put each item on its own line)
	* or "," (to list items inline, separated by commas).
	* @return string Rendered list of handle links.
	*/
	protected function renderHandlesForPHIDs(array $phids, $style = "\n") {
	$style_map = array(
	"\n" => phutil_tag('br'),
	',' => ', ',
	);

	if (empty($style_map[$style])) {
	throw new Exception("Unknown handle list style '{$style}'!");
	}

	return implode_selected_handle_links($style_map[$style],
	$this->getLoadedHandles(),
	$phids);
	}

	protected function buildApplicationMenu() {
	return null;
	}

	protected function buildApplicationCrumbs() {

	$crumbs = array();

	$application = $this->getCurrentApplication();
	if ($application) {
	$sprite = $application->getIconName();
	if (!$sprite) {
	$sprite = 'application';
	}

	$crumbs[] = id(new PhabricatorCrumbView())
	->setHref($this->getApplicationURI())
	->setIcon($sprite);
	}

	$view = new PhabricatorCrumbsView();
	foreach ($crumbs as $crumb) {
	$view->addCrumb($crumb);
	}

	return $view;
	}

	}
	diff --git a/src/applications/config/option/PhabricatorAuthenticationConfigOptions.php b/src/applications/config/option/PhabricatorAuthenticationConfigOptions.php
	index d2f49d4886..9be99adff2 100644
	--- a/src/applications/config/option/PhabricatorAuthenticationConfigOptions.php
	+++ b/src/applications/config/option/PhabricatorAuthenticationConfigOptions.php
	@@ -1,123 +1,110 @@
	<?php

	final class PhabricatorAuthenticationConfigOptions
	extends PhabricatorApplicationConfigOptions {

	public function getName() {
	return pht("Authentication");
	}

	public function getDescription() {
	return pht("Options relating to authentication.");
	}

	public function getOptions() {
	return array(
	- $this->newOption(
	- 'auth.password-auth-enabled', 'bool', true)
	- ->setBoolOptions(
	- array(
	- pht("Allow password authentication"),
	- pht("Don't allow password authentication")
	- ))
	- ->setSummary(pht("Enables password-based authentication."))
	- ->setDescription(
	- pht(
	- "Can users login with a username/password, or by following the ".
	- "link from a password reset email? You can disable this and ".
	- "configure one or more OAuth providers instead.")),
	$this->newOption('auth.sessions.web', 'int', 5)
	->setSummary(
	pht("Number of web sessions a user can have simultaneously."))
	->setDescription(
	pht(
	"Maximum number of simultaneous web sessions each user is ".
	"permitted to have. Setting this to '1' will prevent a user from ".
	"logging in on more than one browser at the same time.")),
	$this->newOption('auth.sessions.conduit', 'int', 5)
	->setSummary(
	pht(
	"Number of simultaneous Conduit sessions each user is permitted."))
	->setDescription(
	pht(
	"Maximum number of simultaneous Conduit sessions each user is ".
	"permitted to have.")),
	$this->newOption('auth.sshkeys.enabled', 'bool', false)
	->setBoolOptions(
	array(
	pht("Enable SSH key storage"),
	pht("Disable SSH key storage")))
	->setSummary(
	pht("Allow users to associate SSH keys with their accounts."))
	->setDescription(
	pht(
	"Set this true to enable the Settings -> SSH Public Keys panel, ".
	"which will allow users to associated SSH public keys with their ".
	"accounts. This is only really useful if you're setting up ".
	"services over SSH and want to use Phabricator for ".
	"authentication; in most situations you can leave this ".
	"disabled.")),
	$this->newOption('auth.require-email-verification', 'bool', false)
	->setBoolOptions(
	array(
	pht("Require email verification"),
	pht("Don't require email verification")
	))
	->setSummary(
	pht("Require email verification before a user can log in."))
	->setDescription(
	pht(
	"If true, email addresses must be verified (by clicking a link ".
	"in an email) before a user can login. By default, verification ".
	"is optional unless 'auth.email-domains' is nonempty.")),
	$this->newOption('auth.email-domains', 'list<string>', array())
	->setSummary(pht("Only allow registration from particular domains."))
	->setDescription(
	pht(
	"You can restrict allowed email addresses to certain domains ".
	"(like 'yourcompany.com') by setting a list of allowed domains ".
	"here. Users will only be allowed to register using email ".
	"addresses at one of the domains, and will only be able to add ".
	"new email addresses for these domains. If you configure this, ".
	"it implies 'auth.require-email-verification'.\n\n".
	"You should omit the '@' from domains. Note that the domain must ".
	"match exactly. If you allow 'yourcompany.com', that permits ".
	"'joe@yourcompany.com' but rejects 'joe@mail.yourcompany.com'."))
	->addExample(
	"yourcompany.com\nmail.yourcompany.com",
	pht('Valid Setting')),
	$this->newOption('auth.login-message', 'string', null)
	->setLocked(true)
	->setSummary(pht("A block of HTML displayed on the login screen."))
	->setDescription(
	pht(
	"You can provide an arbitrary block of HTML here, which will ".
	"appear on the login screen. Normally, you'd use this to provide ".
	"login or registration instructions to users.")),
	$this->newOption('account.editable', 'bool', true)
	->setBoolOptions(
	array(
	pht("Allow editing"),
	pht("Prevent editing")
	))
	->setSummary(
	pht(
	"Determines whether or not basic account information is ".
	"editable."))
	->setDescription(
	pht(
	"Is basic account information (email, real name, profile ".
	"picture) editable? If you set up Phabricator to automatically ".
	"synchronize account information from some other authoritative ".
	"system, you can disable this to ensure information remains ".
	"consistent across both systems.")),
	$this->newOption('account.minimum-password-length', 'int', 8)
	->setSummary(pht("Minimum password length."))
	->setDescription(
	pht(
	"When users set or reset a password, it must have at least this ".
	"many characters.")),
	);
	}

	}
	diff --git a/src/applications/config/option/PhabricatorExtendingPhabricatorConfigOptions.php b/src/applications/config/option/PhabricatorExtendingPhabricatorConfigOptions.php
	index 6f3cd66a7a..0b5b33b577 100644
	--- a/src/applications/config/option/PhabricatorExtendingPhabricatorConfigOptions.php
	+++ b/src/applications/config/option/PhabricatorExtendingPhabricatorConfigOptions.php
	@@ -1,59 +1,53 @@
	<?php

	final class PhabricatorExtendingPhabricatorConfigOptions
	extends PhabricatorApplicationConfigOptions {

	public function getName() {
	return pht("Extending Phabricator");
	}

	public function getDescription() {
	return pht("Make Phabricator even cooler!");
	}

	public function getOptions() {
	return array(
	$this->newOption('load-libraries', 'list<string>', array())
	->setLocked(true)
	->setSummary(pht("Paths to additional phutil libraries to load."))
	->addExample('/srv/our-libs/sekrit-phutil', pht('Valid Setting')),
	$this->newOption('events.listeners', 'list<string>', array())
	->setLocked(true)
	->setSummary(
	pht("Listeners receive callbacks when interesting things occur."))
	->setDescription(
	pht(
	"You can respond to various application events by installing ".
	"listeners, which will receive callbacks when interesting things ".
	"occur. Specify a list of classes which extend ".
	"PhabricatorEventListener here."))
	->addExample('MyEventListener', pht('Valid Setting')),
	$this->newOption(
	'celerity.resource-path',
	'string',
	'__celerity_resource_map__.php')
	->setLocked(true)
	->setSummary(
	pht("Custom celerity resource map."))
	->setDescription(
	pht(
	"Path to custom celerity resource map relative to ".
	"'phabricator/src'. See also `scripts/celerity_mapper.php`."))
	->addExample('local/my_celerity_map.php', pht('Valid Setting')),
	$this->newOption(
	'aphront.default-application-configuration-class',
	'class',
	'AphrontDefaultApplicationConfiguration')
	->setBaseClass('AphrontApplicationConfiguration')
	// TODO: This could probably use some better documentation.
	->setDescription(pht("Application configuration class.")),
	- $this->newOption(
	- 'controller.oauth-registration',
	- 'class',
	- 'PhabricatorOAuthDefaultRegistrationController')
	- ->setBaseClass('PhabricatorOAuthRegistrationController')
	- ->setDescription(pht("OAuth registration controller.")),
	);
	}

	}
	diff --git a/src/applications/people/storage/PhabricatorUser.php b/src/applications/people/storage/PhabricatorUser.php
	index 16016a3be5..324131194d 100644
	--- a/src/applications/people/storage/PhabricatorUser.php
	+++ b/src/applications/people/storage/PhabricatorUser.php
	@@ -1,790 +1,790 @@
	<?php

	final class PhabricatorUser
	extends PhabricatorUserDAO
	implements
	PhutilPerson,
	PhabricatorPolicyInterface,
	PhabricatorCustomFieldInterface {

	const SESSION_TABLE = 'phabricator_session';
	const NAMETOKEN_TABLE = 'user_nametoken';

	protected $phid;
	protected $userName;
	protected $realName;
	protected $sex;
	protected $translation;
	protected $passwordSalt;
	protected $passwordHash;
	protected $profileImagePHID;
	protected $timezoneIdentifier = '';

	protected $consoleEnabled = 0;
	protected $consoleVisible = 0;
	protected $consoleTab = '';

	protected $conduitCertificate;

	protected $isSystemAgent = 0;
	protected $isAdmin = 0;
	protected $isDisabled = 0;

	private $profileImage = null;
	private $profile = null;
	private $status = null;
	private $preferences = null;
	private $omnipotent = false;
	private $customFields = array();

	protected function readField($field) {
	switch ($field) {
	case 'timezoneIdentifier':
	// If the user hasn't set one, guess the server's time.
	return nonempty(
	$this->timezoneIdentifier,
	date_default_timezone_get());
	// Make sure these return booleans.
	case 'isAdmin':
	return (bool)$this->isAdmin;
	case 'isDisabled':
	return (bool)$this->isDisabled;
	case 'isSystemAgent':
	return (bool)$this->isSystemAgent;
	default:
	return parent::readField($field);
	}
	}

	public function getConfiguration() {
	return array(
	self::CONFIG_AUX_PHID => true,
	self::CONFIG_PARTIAL_OBJECTS => true,
	) + parent::getConfiguration();
	}

	public function generatePHID() {
	return PhabricatorPHID::generateNewPHID(
	PhabricatorPHIDConstants::PHID_TYPE_USER);
	}

	public function setPassword(PhutilOpaqueEnvelope $envelope) {
	if (!$this->getPHID()) {
	throw new Exception(
	"You can not set a password for an unsaved user because their PHID ".
	"is a salt component in the password hash.");
	}

	if (!strlen($envelope->openEnvelope())) {
	$this->setPasswordHash('');
	} else {
	$this->setPasswordSalt(md5(mt_rand()));
	$hash = $this->hashPassword($envelope);
	$this->setPasswordHash($hash);
	}
	return $this;
	}

	// To satisfy PhutilPerson.
	public function getSex() {
	return $this->sex;
	}

	public function getTranslation() {
	try {
	if ($this->translation &&
	class_exists($this->translation) &&
	is_subclass_of($this->translation, 'PhabricatorTranslation')) {
	return $this->translation;
	}
	} catch (PhutilMissingSymbolException $ex) {
	return null;
	}
	return null;
	}

	public function isLoggedIn() {
	return !($this->getPHID() === null);
	}

	public function save() {
	if (!$this->getConduitCertificate()) {
	$this->setConduitCertificate($this->generateConduitCertificate());
	}
	$result = parent::save();

	if ($this->profile) {
	$this->profile->save();
	}

	$this->updateNameTokens();

	id(new PhabricatorSearchIndexer())
	->indexDocumentByPHID($this->getPHID());

	return $result;
	}

	private function generateConduitCertificate() {
	return Filesystem::readRandomCharacters(255);
	}

	public function comparePassword(PhutilOpaqueEnvelope $envelope) {
	if (!strlen($envelope->openEnvelope())) {
	return false;
	}
	if (!strlen($this->getPasswordHash())) {
	return false;
	}
	$password_hash = $this->hashPassword($envelope);
	return ($password_hash === $this->getPasswordHash());
	}

	private function hashPassword(PhutilOpaqueEnvelope $envelope) {
	$hash = $this->getUsername().
	$envelope->openEnvelope().
	$this->getPHID().
	$this->getPasswordSalt();
	for ($ii = 0; $ii < 1000; $ii++) {
	$hash = md5($hash);
	}
	return $hash;
	}

	const CSRF_CYCLE_FREQUENCY = 3600;
	const CSRF_TOKEN_LENGTH = 16;

	const EMAIL_CYCLE_FREQUENCY = 86400;
	const EMAIL_TOKEN_LENGTH = 24;

	public function getCSRFToken($offset = 0) {
	return $this->generateToken(
	time() + (self::CSRF_CYCLE_FREQUENCY * $offset),
	self::CSRF_CYCLE_FREQUENCY,
	PhabricatorEnv::getEnvConfig('phabricator.csrf-key'),
	self::CSRF_TOKEN_LENGTH);
	}

	public function validateCSRFToken($token) {

	if (!$this->getPHID()) {
	return true;
	}

	// When the user posts a form, we check that it contains a valid CSRF token.
	// Tokens cycle each hour (every CSRF_CYLCE_FREQUENCY seconds) and we accept
	// either the current token, the next token (users can submit a "future"
	// token if you have two web frontends that have some clock skew) or any of
	// the last 6 tokens. This means that pages are valid for up to 7 hours.
	// There is also some Javascript which periodically refreshes the CSRF
	// tokens on each page, so theoretically pages should be valid indefinitely.
	// However, this code may fail to run (if the user loses their internet
	// connection, or there's a JS problem, or they don't have JS enabled).
	// Choosing the size of the window in which we accept old CSRF tokens is
	// an issue of balancing concerns between security and usability. We could
	// choose a very narrow (e.g., 1-hour) window to reduce vulnerability to
	// attacks using captured CSRF tokens, but it's also more likely that real
	// users will be affected by this, e.g. if they close their laptop for an
	// hour, open it back up, and try to submit a form before the CSRF refresh
	// can kick in. Since the user experience of submitting a form with expired
	// CSRF is often quite bad (you basically lose data, or it's a big pain to
	// recover at least) and I believe we gain little additional protection
	// by keeping the window very short (the overwhelming value here is in
	// preventing blind attacks, and most attacks which can capture CSRF tokens
	// can also just capture authentication information [sniffing networks]
	// or act as the user [xss]) the 7 hour default seems like a reasonable
	// balance. Other major platforms have much longer CSRF token lifetimes,
	// like Rails (session duration) and Django (forever), which suggests this
	// is a reasonable analysis.
	$csrf_window = 6;

	for ($ii = -$csrf_window; $ii <= 1; $ii++) {
	$valid = $this->getCSRFToken($ii);
	if ($token == $valid) {
	return true;
	}
	}

	return false;
	}

	private function generateToken($epoch, $frequency, $key, $len) {
	$time_block = floor($epoch / $frequency);
	$vec = $this->getPHID().$this->getPasswordHash().$key.$time_block;
	return substr(PhabricatorHash::digest($vec), 0, $len);
	}

	/**
	* Issue a new session key to this user. Phabricator supports different
	* types of sessions (like "web" and "conduit") and each session type may
	* have multiple concurrent sessions (this allows a user to be logged in on
	* multiple browsers at the same time, for instance).
	*
	* Note that this method is transport-agnostic and does not set cookies or
	* issue other types of tokens, it ONLY generates a new session key.
	*
	* You can configure the maximum number of concurrent sessions for various
	* session types in the Phabricator configuration.
	*
	* @param string Session type, like "web".
	* @return string Newly generated session key.
	*/
	public function establishSession($session_type) {
	$conn_w = $this->establishConnection('w');

	if (strpos($session_type, '-') !== false) {
	throw new Exception("Session type must not contain hyphen ('-')!");
	}

	// We allow multiple sessions of the same type, so when a caller requests
	// a new session of type "web", we give them the first available session in
	// "web-1", "web-2", ..., "web-N", up to some configurable limit. If none
	// of these sessions is available, we overwrite the oldest session and
	// reissue a new one in its place.

	$session_limit = 1;
	switch ($session_type) {
	case 'web':
	$session_limit = PhabricatorEnv::getEnvConfig('auth.sessions.web');
	break;
	case 'conduit':
	$session_limit = PhabricatorEnv::getEnvConfig('auth.sessions.conduit');
	break;
	default:
	throw new Exception("Unknown session type '{$session_type}'!");
	}

	$session_limit = (int)$session_limit;
	if ($session_limit <= 0) {
	throw new Exception(
	"Session limit for '{$session_type}' must be at least 1!");
	}

	// NOTE: Session establishment is sensitive to race conditions, as when
	// piping `arc` to `arc`:
	//
	// arc export ... \| arc paste ...
	//
	// To avoid this, we overwrite an old session only if it hasn't been
	// re-established since we read it.

	// Consume entropy to generate a new session key, forestalling the eventual
	// heat death of the universe.
	$session_key = Filesystem::readRandomCharacters(40);

	// Load all the currently active sessions.
	$sessions = queryfx_all(
	$conn_w,
	'SELECT type, sessionKey, sessionStart FROM %T
	WHERE userPHID = %s AND type LIKE %>',
	PhabricatorUser::SESSION_TABLE,
	$this->getPHID(),
	$session_type.'-');
	$sessions = ipull($sessions, null, 'type');
	$sessions = isort($sessions, 'sessionStart');

	$existing_sessions = array_keys($sessions);

	// UNGUARDED WRITES: Logging-in users don't have CSRF stuff yet.
	$unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();

	$retries = 0;
	while (true) {


	// Choose which 'type' we'll actually establish, i.e. what number we're
	// going to append to the basic session type. To do this, just check all
	// the numbers sequentially until we find an available session.
	$establish_type = null;
	for ($ii = 1; $ii <= $session_limit; $ii++) {
	$try_type = $session_type.'-'.$ii;
	if (!in_array($try_type, $existing_sessions)) {
	$establish_type = $try_type;
	$expect_key = PhabricatorHash::digest($session_key);
	$existing_sessions[] = $try_type;

	// Ensure the row exists so we can issue an update below. We don't
	// care if we race here or not.
	queryfx(
	$conn_w,
	'INSERT IGNORE INTO %T (userPHID, type, sessionKey, sessionStart)
	VALUES (%s, %s, %s, 0)',
	self::SESSION_TABLE,
	$this->getPHID(),
	$establish_type,
	PhabricatorHash::digest($session_key));
	break;
	}
	}

	// If we didn't find an available session, choose the oldest session and
	// overwrite it.
	if (!$establish_type) {
	$oldest = reset($sessions);
	$establish_type = $oldest['type'];
	$expect_key = $oldest['sessionKey'];
	}

	// This is so that we'll only overwrite the session if it hasn't been
	// refreshed since we read it. If it has, the session key will be
	// different and we know we're racing other processes. Whichever one
	// won gets the session, we go back and try again.

	queryfx(
	$conn_w,
	'UPDATE %T SET sessionKey = %s, sessionStart = UNIX_TIMESTAMP()
	WHERE userPHID = %s AND type = %s AND sessionKey = %s',
	self::SESSION_TABLE,
	PhabricatorHash::digest($session_key),
	$this->getPHID(),
	$establish_type,
	$expect_key);

	if ($conn_w->getAffectedRows()) {
	// The update worked, so the session is valid.
	break;
	} else {
	// We know this just got grabbed, so don't try it again.
	unset($sessions[$establish_type]);
	}

	if (++$retries > $session_limit) {
	throw new Exception("Failed to establish a session!");
	}
	}

	$log = PhabricatorUserLog::newLog(
	$this,
	$this,
	PhabricatorUserLog::ACTION_LOGIN);
	$log->setDetails(
	array(
	'session_type' => $session_type,
	'session_issued' => $establish_type,
	));
	$log->setSession($session_key);
	$log->save();

	return $session_key;
	}

	public function destroySession($session_key) {
	$conn_w = $this->establishConnection('w');
	queryfx(
	$conn_w,
	'DELETE FROM %T WHERE userPHID = %s AND sessionKey = %s',
	self::SESSION_TABLE,
	$this->getPHID(),
	PhabricatorHash::digest($session_key));
	}

	private function generateEmailToken(
	PhabricatorUserEmail $email,
	$offset = 0) {

	$key = implode(
	'-',
	array(
	PhabricatorEnv::getEnvConfig('phabricator.csrf-key'),
	$this->getPHID(),
	$email->getVerificationCode(),
	));

	return $this->generateToken(
	time() + ($offset * self::EMAIL_CYCLE_FREQUENCY),
	self::EMAIL_CYCLE_FREQUENCY,
	$key,
	self::EMAIL_TOKEN_LENGTH);
	}

	public function validateEmailToken(
	PhabricatorUserEmail $email,
	$token) {
	for ($ii = -1; $ii <= 1; $ii++) {
	$valid = $this->generateEmailToken($email, $ii);
	if ($token == $valid) {
	return true;
	}
	}
	return false;
	}

	public function getEmailLoginURI(PhabricatorUserEmail $email = null) {
	if (!$email) {
	$email = $this->loadPrimaryEmail();
	if (!$email) {
	throw new Exception("User has no primary email!");
	}
	}
	$token = $this->generateEmailToken($email);
	$uri = PhabricatorEnv::getProductionURI('/login/etoken/'.$token.'/');
	$uri = new PhutilURI($uri);
	return $uri->alter('email', $email->getAddress());
	}

	public function attachUserProfile(PhabricatorUserProfile $profile) {
	$this->profile = $profile;
	return $this;
	}

	public function loadUserProfile() {
	if ($this->profile) {
	return $this->profile;
	}

	$profile_dao = new PhabricatorUserProfile();
	$this->profile = $profile_dao->loadOneWhere('userPHID = %s',
	$this->getPHID());

	if (!$this->profile) {
	$profile_dao->setUserPHID($this->getPHID());
	$this->profile = $profile_dao;
	}

	return $this->profile;
	}

	public function loadPrimaryEmailAddress() {
	$email = $this->loadPrimaryEmail();
	if (!$email) {
	throw new Exception("User has no primary email address!");
	}
	return $email->getAddress();
	}

	public function loadPrimaryEmail() {
	return $this->loadOneRelative(
	new PhabricatorUserEmail(),
	'userPHID',
	'getPHID',
	'(isPrimary = 1)');
	}

	public function loadPreferences() {
	if ($this->preferences) {
	return $this->preferences;
	}

	$preferences = id(new PhabricatorUserPreferences())->loadOneWhere(
	'userPHID = %s',
	$this->getPHID());

	if (!$preferences) {
	$preferences = new PhabricatorUserPreferences();
	$preferences->setUserPHID($this->getPHID());

	$default_dict = array(
	PhabricatorUserPreferences::PREFERENCE_TITLES => 'glyph',
	PhabricatorUserPreferences::PREFERENCE_EDITOR => '',
	PhabricatorUserPreferences::PREFERENCE_MONOSPACED => '',
	PhabricatorUserPreferences::PREFERENCE_DARK_CONSOLE => 0);

	$preferences->setPreferences($default_dict);
	}

	$this->preferences = $preferences;
	return $preferences;
	}

	public function loadEditorLink($path, $line, $callsign) {
	$editor = $this->loadPreferences()->getPreference(
	PhabricatorUserPreferences::PREFERENCE_EDITOR);

	if (is_array($path)) {
	$multiedit = $this->loadPreferences()->getPreference(
	PhabricatorUserPreferences::PREFERENCE_MULTIEDIT);
	switch ($multiedit) {
	case '':
	$path = implode(' ', $path);
	break;
	case 'disable':
	return null;
	}
	}

	if ($editor) {
	return strtr($editor, array(
	'%%' => '%',
	'%f' => phutil_escape_uri($path),
	'%l' => phutil_escape_uri($line),
	'%r' => phutil_escape_uri($callsign),
	));
	}
	}

	private static function tokenizeName($name) {
	if (function_exists('mb_strtolower')) {
	$name = mb_strtolower($name, 'UTF-8');
	} else {
	$name = strtolower($name);
	}
	$name = trim($name);
	if (!strlen($name)) {
	return array();
	}
	return preg_split('/\s+/', $name);
	}

	/**
	* Populate the nametoken table, which used to fetch typeahead results. When
	* a user types "linc", we want to match "Abraham Lincoln" from on-demand
	* typeahead sources. To do this, we need a separate table of name fragments.
	*/
	public function updateNameTokens() {
	$tokens = array_merge(
	self::tokenizeName($this->getRealName()),
	self::tokenizeName($this->getUserName()));
	$tokens = array_unique($tokens);
	$table = self::NAMETOKEN_TABLE;
	$conn_w = $this->establishConnection('w');

	$sql = array();
	foreach ($tokens as $token) {
	$sql[] = qsprintf(
	$conn_w,
	'(%d, %s)',
	$this->getID(),
	$token);
	}

	queryfx(
	$conn_w,
	'DELETE FROM %T WHERE userID = %d',
	$table,
	$this->getID());
	if ($sql) {
	queryfx(
	$conn_w,
	'INSERT INTO %T (userID, token) VALUES %Q',
	$table,
	implode(', ', $sql));
	}
	}

	public function sendWelcomeEmail(PhabricatorUser $admin) {
	$admin_username = $admin->getUserName();
	$admin_realname = $admin->getRealName();
	$user_username = $this->getUserName();
	$is_serious = PhabricatorEnv::getEnvConfig('phabricator.serious-business');

	$base_uri = PhabricatorEnv::getProductionURI('/');

	$uri = $this->getEmailLoginURI();
	$body = <<<EOBODY
	Welcome to Phabricator!

	{$admin_username} ({$admin_realname}) has created an account for you.

	Username: {$user_username}

	To login to Phabricator, follow this link and set a password:

	{$uri}

	After you have set a password, you can login in the future by going here:

	{$base_uri}

	EOBODY;

	if (!$is_serious) {
	$body .= <<<EOBODY

	Love,
	Phabricator

	EOBODY;
	}

	$mail = id(new PhabricatorMetaMTAMail())
	->addTos(array($this->getPHID()))
	->setSubject('[Phabricator] Welcome to Phabricator')
	->setBody($body)
	->saveAndSend();
	}

	public function sendUsernameChangeEmail(
	PhabricatorUser $admin,
	$old_username) {

	$admin_username = $admin->getUserName();
	$admin_realname = $admin->getRealName();
	$new_username = $this->getUserName();

	$password_instructions = null;
	- if (PhabricatorEnv::getEnvConfig('auth.password-auth-enabled')) {
	+ if (PhabricatorAuthProviderPassword::getPasswordProvider()) {
	$uri = $this->getEmailLoginURI();
	$password_instructions = <<<EOTXT
	If you use a password to login, you'll need to reset it before you can login
	again. You can reset your password by following this link:

	{$uri}

	And, of course, you'll need to use your new username to login from now on. If
	you use OAuth to login, nothing should change.

	EOTXT;
	}

	$body = <<<EOBODY
	{$admin_username} ({$admin_realname}) has changed your Phabricator username.

	Old Username: {$old_username}
	New Username: {$new_username}

	{$password_instructions}
	EOBODY;

	$mail = id(new PhabricatorMetaMTAMail())
	->addTos(array($this->getPHID()))
	->setSubject('[Phabricator] Username Changed')
	->setBody($body)
	->saveAndSend();
	}

	public static function describeValidUsername() {
	return 'Usernames must contain only numbers, letters, period, underscore '.
	'and hyphen, and can not end with a period.';
	}

	public static function validateUsername($username) {
	// NOTE: If you update this, make sure to update:
	//
	// - Remarkup rule for @mentions.
	// - Routing rule for "/p/username/".
	// - Unit tests, obviously.
	// - describeValidUsername() method, above.

	return (bool)preg_match('/^[a-zA-Z0-9._-]*[a-zA-Z0-9_-]$/', $username);
	}

	public static function getDefaultProfileImageURI() {
	return celerity_get_resource_uri('/rsrc/image/avatar.png');
	}

	public function attachProfileImageURI($uri) {
	$this->profileImage = $uri;
	return $this;
	}

	public function loadProfileImageURI() {
	if ($this->profileImage) {
	return $this->profileImage;
	}

	$src_phid = $this->getProfileImagePHID();

	if ($src_phid) {
	$file = id(new PhabricatorFile())->loadOneWhere('phid = %s', $src_phid);
	if ($file) {
	$this->profileImage = $file->getBestURI();
	}
	}

	if (!$this->profileImage) {
	$this->profileImage = self::getDefaultProfileImageURI();
	}

	return $this->profileImage;
	}

	public function getFullName() {
	return $this->getUsername().' ('.$this->getRealName().')';
	}

	public function __toString() {
	return $this->getUsername();
	}

	public static function loadOneWithEmailAddress($address) {
	$email = id(new PhabricatorUserEmail())->loadOneWhere(
	'address = %s',
	$address);
	if (!$email) {
	return null;
	}
	return id(new PhabricatorUser())->loadOneWhere(
	'phid = %s',
	$email->getUserPHID());
	}


	/* -( Omnipotence )-------------------------------------------------------- */


	/**
	* Returns true if this user is omnipotent. Omnipotent users bypass all policy
	* checks.
	*
	* @return bool True if the user bypasses policy checks.
	*/
	public function isOmnipotent() {
	return $this->omnipotent;
	}


	/**
	* Get an omnipotent user object for use in contexts where there is no acting
	* user, notably daemons.
	*
	* @return PhabricatorUser An omnipotent user.
	*/
	public static function getOmnipotentUser() {
	static $user = null;
	if (!$user) {
	$user = new PhabricatorUser();
	$user->omnipotent = true;
	$user->makeEphemeral();
	}
	return $user;
	}


	/* -( PhabricatorPolicyInterface )----------------------------------------- */


	public function getCapabilities() {
	return array(
	PhabricatorPolicyCapability::CAN_VIEW,
	PhabricatorPolicyCapability::CAN_EDIT,
	);
	}

	public function getPolicy($capability) {
	switch ($capability) {
	case PhabricatorPolicyCapability::CAN_VIEW:
	return PhabricatorPolicies::POLICY_PUBLIC;
	case PhabricatorPolicyCapability::CAN_EDIT:
	return PhabricatorPolicies::POLICY_NOONE;
	}
	}

	public function hasAutomaticCapability($capability, PhabricatorUser $viewer) {
	return $this->getPHID() && ($viewer->getPHID() === $this->getPHID());
	}


	/* -( PhabricatorCustomFieldInterface )------------------------------------ */


	public function getCustomFieldSpecificationForRole($role) {
	return PhabricatorEnv::getEnvConfig('user.fields');
	}

	public function getCustomFieldBaseClass() {
	return 'PhabricatorUserCustomFieldInterface';
	}

	public function getCustomFields($role) {
	if (idx($this->customFields, $role) === null) {
	PhabricatorCustomField::raiseUnattachedException($this, $role);
	}
	return $this->customFields[$role];
	}

	public function attachCustomFields($role, array $fields) {
	$this->customFields[$role] = $fields;
	return $this;
	}

	}
	diff --git a/src/applications/settings/panel/PhabricatorSettingsPanelPassword.php b/src/applications/settings/panel/PhabricatorSettingsPanelPassword.php
	index 155037428e..1b3e7dd1fc 100644
	--- a/src/applications/settings/panel/PhabricatorSettingsPanelPassword.php
	+++ b/src/applications/settings/panel/PhabricatorSettingsPanelPassword.php
	@@ -1,171 +1,171 @@
	<?php

	final class PhabricatorSettingsPanelPassword
	extends PhabricatorSettingsPanel {

	public function getPanelKey() {
	return 'password';
	}

	public function getPanelName() {
	return pht('Password');
	}

	public function getPanelGroup() {
	return pht('Authentication');
	}

	public function isEnabled() {
	// There's no sense in showing a change password panel if the user
	// can't change their password...

	if (!PhabricatorEnv::getEnvConfig('account.editable')) {
	return false;
	}

	// ...or this install doesn't support password authentication at all.

	- if (!PhabricatorEnv::getEnvConfig('auth.password-auth-enabled')) {
	+ if (!PhabricatorAuthProviderPassword::getPasswordProvider()) {
	return false;
	}

	return true;
	}

	public function processRequest(AphrontRequest $request) {
	$user = $request->getUser();

	$min_len = PhabricatorEnv::getEnvConfig('account.minimum-password-length');
	$min_len = (int)$min_len;

	// NOTE: To change your password, you need to prove you own the account,
	// either by providing the old password or by carrying a token to
	// the workflow from a password reset email.

	$token = $request->getStr('token');

	$valid_token = false;
	if ($token) {
	$email_address = $request->getStr('email');
	$email = id(new PhabricatorUserEmail())->loadOneWhere(
	'address = %s',
	$email_address);
	if ($email) {
	$valid_token = $user->validateEmailToken($email, $token);
	}
	}

	$e_old = true;
	$e_new = true;
	$e_conf = true;

	$errors = array();
	if ($request->isFormPost()) {
	if (!$valid_token) {
	$envelope = new PhutilOpaqueEnvelope($request->getStr('old_pw'));
	if (!$user->comparePassword($envelope)) {
	$errors[] = pht('The old password you entered is incorrect.');
	$e_old = pht('Invalid');
	}
	}

	$pass = $request->getStr('new_pw');
	$conf = $request->getStr('conf_pw');

	if (strlen($pass) < $min_len) {
	$errors[] = pht('Your new password is too short.');
	$e_new = pht('Too Short');
	}

	if ($pass !== $conf) {
	$errors[] = pht('New password and confirmation do not match.');
	$e_conf = pht('Invalid');
	}

	if (!$errors) {
	// This write is unguarded because the CSRF token has already
	// been checked in the call to $request->isFormPost() and
	// the CSRF token depends on the password hash, so when it
	// is changed here the CSRF token check will fail.
	$unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();

	$envelope = new PhutilOpaqueEnvelope($pass);
	id(new PhabricatorUserEditor())
	->setActor($user)
	->changePassword($user, $envelope);

	unset($unguarded);

	if ($valid_token) {
	// If this is a password set/reset, kick the user to the home page
	// after we update their account.
	$next = '/';
	} else {
	$next = $this->getPanelURI('?saved=true');
	}

	return id(new AphrontRedirectResponse())->setURI($next);
	}
	}

	$notice = null;
	if (!$errors) {
	if ($request->getStr('saved')) {
	$notice = new AphrontErrorView();
	$notice->setSeverity(AphrontErrorView::SEVERITY_NOTICE);
	$notice->setTitle(pht('Changes Saved'));
	$notice->appendChild(
	phutil_tag('p', array(), pht('Your password has been updated.')));
	}
	} else {
	$notice = new AphrontErrorView();
	$notice->setTitle(pht('Error Changing Password'));
	$notice->setErrors($errors);
	}

	$len_caption = null;
	if ($min_len) {
	$len_caption = pht('Minimum password length: %d characters.', $min_len);
	}

	$form = new AphrontFormView();
	$form
	->setUser($user)
	->addHiddenInput('token', $token);

	if (!$valid_token) {
	$form->appendChild(
	id(new AphrontFormPasswordControl())
	->setLabel(pht('Old Password'))
	->setError($e_old)
	->setName('old_pw'));
	}

	$form
	->appendChild(
	id(new AphrontFormPasswordControl())
	->setLabel(pht('New Password'))
	->setError($e_new)
	->setName('new_pw'));
	$form
	->appendChild(
	id(new AphrontFormPasswordControl())
	->setLabel(pht('Confirm Password'))
	->setCaption($len_caption)
	->setError($e_conf)
	->setName('conf_pw'));
	$form
	->appendChild(
	id(new AphrontFormSubmitControl())
	->setValue(pht('Save')));

	$header = new PhabricatorHeaderView();
	$header->setHeader(pht('Change Password'));

	return array(
	$notice,
	$header,
	$form,
	);
	}
	}
	diff --git a/src/docs/configuration/configuration_guide.diviner b/src/docs/configuration/configuration_guide.diviner
	index b5e2c5c69d..7c09335a5f 100644
	--- a/src/docs/configuration/configuration_guide.diviner
	+++ b/src/docs/configuration/configuration_guide.diviner
	@@ -1,194 +1,197 @@
	@title Configuration Guide
	@group config

	This document contains basic configuration instructions for Phabricator.

	= Prerequisites =

	This document assumes you've already installed all the components you need.
	If you haven't, see @{article:Installation Guide}.

	The next steps are:

	- Configure your webserver (Apache, nginx, or lighttpd).
	- Access Phabricator with your browser.
	- Follow the instructions to complete setup.

	= Webserver: Configuring Apache =

	NOTE: Follow these instructions to use Apache. To use nginx or lighttpd, scroll
	down to their sections.

	Get Apache running and verify it's serving a test page. Consult the Apache
	documentation for help. Make sure ##mod_php## and ##mod_rewrite## are enabled,
	and ##mod_ssl## if you intend to set up SSL.

	If you haven't already, set up a domain name to point to the host you're
	installing on. You can either install Phabricator on a subdomain (like
	phabricator.example.com) or an entire domain, but you can not install it in
	some subdirectory of an existing website. Navigate to whatever domain you're
	going to use and make sure Apache serves you something to verify that DNS
	is correctly configured.

	NOTE: The domain must contain a dot ('.'), i.e. not be just a bare name like
	'http://example/'. Some web browsers will not set cookies otherwise.

	Now, either create a VirtualHost entry (to put Phabricator on a subdomain)
	or edit the Directory entry for the DocumentRoot. It should look something like
	this:

	name=httpd.conf
	<VirtualHost *>
	# Change this to the domain which points to your host.
	ServerName phabricator.example.com

	# Change this to the path where you put 'phabricator' when you checked it
	# out from GitHub when following the Installation Guide.
	#
	# Make sure you include "/webroot" at the end!
	DocumentRoot /path/to/phabricator/webroot

	RewriteEngine on
	RewriteRule ^/rsrc/(.*) - [L,QSA]
	RewriteRule ^/favicon.ico - [L,QSA]
	RewriteRule ^(.*)$ /index.php?__path__=$1 [B,L,QSA]
	</VirtualHost>

	If Apache isn't currently configured to serve documents out of the directory
	where you put Phabricator, you may also need to add a section like this:

	<Directory "/path/to/phabricator/webroot">
	Order allow,deny
	Allow from all
	</Directory>

	After making your edits, restart Apache, then continue to "Setup" below.

	= Webserver: Configuring nginx =

	NOTE: Follow these instructions to use nginx. To use Apache or lighttpd, scroll
	to their sections.

	For nginx, use a configuration like this:

	name=nginx.conf
	server {
	server_name phabricator.example.com;

	root /path/to/phabricator/webroot;
	try_files $uri $uri/ /index.php;

	location / {
	index index.php;

	if ( !-f $request_filename )
	{
	rewrite ^/(.*)$ /index.php?__path__=/$1 last;
	break;
	}
	}

	location /index.php {
	fastcgi_pass localhost:9000;
	fastcgi_index index.php;

	#required if PHP was built with --enable-force-cgi-redirect
	fastcgi_param REDIRECT_STATUS 200;

	#variables to make the $_SERVER populate in PHP
	fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
	fastcgi_param QUERY_STRING $query_string;
	fastcgi_param REQUEST_METHOD $request_method;
	fastcgi_param CONTENT_TYPE $content_type;
	fastcgi_param CONTENT_LENGTH $content_length;

	fastcgi_param SCRIPT_NAME $fastcgi_script_name;

	fastcgi_param GATEWAY_INTERFACE CGI/1.1;
	fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;

	fastcgi_param REMOTE_ADDR $remote_addr;
	}
	}

	Restart nginx after making your edits, then continue to "Setup" below.

	= Webserver: Configuring lighttpd =

	NOTE: Follow these instructions to use lighttpd. To use Apache or niginx, scroll
	up to their sections.

	For lighttpd, add a section like this to your lighttpd.conf:

	$HTTP["host"] =~ "phabricator(\.example\.com)?" {
	server.document-root = "/path/to/phabricator/webroot"
	url.rewrite-once = (
	"^(/rsrc/.*)$" => "$1",
	"^(/favicon.ico)$" => "$1",
	# This simulates QSA ("query string append") mode in apache
	"^(/[^?])\?(.)" => "/index.php?__path__=$1&$2",
	"^(/.*)$" => "/index.php?__path__=$1",
	)
	}

	You should also ensure the following modules are listed in your
	server.modules list:

	mod_fastcgi
	mod_rewrite

	Finally, you should run the following commands to enable php support:

	$ sudo apt-get install php5-cgi # for ubuntu; other distros should be similar
	$ sudo lighty-enable-mod fastcgi-php

	Restart lighttpd after making your edits, then continue below.

	= Setup =

	Now, navigate to whichever subdomain you set up. You should see instructions to
	continue setup. The rest of this document contains additional instructions for
	specific setup steps.

	-When you see the login screen, continue with @{article:Configuring Accounts and
	-Registration}.
	+When you resolve any issues and see the welcome screen, enter credentials to
	+create your initial administrator account. After you log in, you'll want to
	+configure how other users will be able to log in or register -- until you do,
	+no one else will be able to sign up or log in. For more information, see
	+@{article:Configuring Accounts and Registration}.

	= Storage: Configuring MySQL =

	During setup, you'll need to configure MySQL. To do this, get MySQL running and
	verify you can connect to it. Consult the MySQL documentation for help. When
	MySQL works, you need to load the Phabricator schemata into it. To do this, run:

	phabricator/ $ ./bin/storage upgrade

	If your configuration uses an unprivileged user to connect to the database, you
	may have to override the default user so the schema changes can be applied with
	root or some other admin user:

	phabricator/ $ ./bin/storage upgrade --user <user> --password <password>

	You can avoid the prompt the script issues by passing the ##--force## flag (for
	example, if you are scripting the upgrade process).

	phabricator/ $ ./bin/storage upgrade --force

	NOTE: When you update Phabricator, run `storage upgrade` again to apply any
	new updates.

	= Next Steps =

	Continue by:

	- setting up your admin account and login/registration with
	@{article:Configuring Accounts and Registration}; or
	- understanding advanced configuration topics with
	@{article:Configuration User Guide: Advanced Configuration}; or
	- configuring where uploaded files and attachments will be stored with
	@{article:Configuring File Storage}; or
	- configuring Phabricator so it can send mail with
	@{article:Configuring Outbound Email}; or
	- configuring inbound mail with @{article:Configuring Inbound Email}; or
	- importing repositories with @{article:Diffusion User Guide}; or
	- learning about daemons with @{article:Managing Daemons with phd}; or
	- configuring backups with @{article:Configuring Backups}; or
	- contributing to Phabricator with @{article:Contributor Introduction}.
	diff --git a/src/docs/configuration/configuring_accounts_and_registration.diviner b/src/docs/configuration/configuring_accounts_and_registration.diviner
	index bd6d5c49ee..35104b1858 100644
	--- a/src/docs/configuration/configuring_accounts_and_registration.diviner
	+++ b/src/docs/configuration/configuring_accounts_and_registration.diviner
	@@ -1,154 +1,69 @@
	@title Configuring Accounts and Registration
	@group config

	Describes how to configure user access to Phabricator.

	= Overview =

	-Phabricator supports a number of login systems, like traditional
	-username/password, Facebook OAuth, GitHub OAuth, and Google OAuth. You can
	-enable or disable these systems to configure who can register for and access
	-your install, and how users with existing accounts can login.
	+Phabricator supports a number of login systems. You can enable or disable these
	+systems to configure who can register for and access your install, and how users
	+with existing accounts can login.

	-By default, only username/password auth is enabled, and there are no valid
	-accounts. Start by creating a new account with the
	-##phabricator/bin/accountadmin## script.
	+Methods of logging in are called Authentication Providers. For example,
	+there is a "Username/Password" authentication provider available, which allows
	+users to log in with a traditional username and password. Other providers
	+support logging in with other credentials. For example:

	-= Using accountadmin =
	+ - Username/Password: Users use a username and password to log in or
	+ register.
	+ - LDAP: Users use LDAP credentials to log in or register.
	+ - OAuth: Users use accounts on a supported OAuth2 provider (like
	+ GitHub, Facebook, or Google) to log in or register.
	+ - Other Providers: More providers are available, and Phabricator
	+ can be extended with custom providers. See the "Auth" application for
	+ a list of available providers.

	-##accountadmin## is a user-friendly command line interface for creating and
	-editing accounts. To use ##accountadmin##, just run the script:
	+By default, no providers are enabled. You must use the "Auth" application to
	+add one or more providers after you complete the installation process.

	- $ ./phabricator/bin/accountadmin
	- Enter a username to create a new account or edit an existing account.
	+After you add a provider, you can link it to existing accounts (for example,
	+associate an existing Phabricator account with a GitHub OAuth account) or users
	+can use it to register new accounts (assuming you enable these options).

	- Enter a username:
	+= Recovering Administrator Accounts =

	-This will walk you through the process of creating an initial user account.
	-Once you've created an account, you can login with it and use the web console
	-to create and manage accounts more easily (provided you make your first account
	-an administrator).
	+If you accidentally lock yourself out of Phabricator, you can use the `bin/auth`
	+script to recover access to an administrator account. To recover access, run:

	-You can use this script later to create or edit accounts if you, for example,
	-accidentally remove your admin flag.
	+ phabricator/ $ ./bin/auth recover <username>
	+
	+...where `<username>` is the admin account username you want to recover access
	+to. This will give you a link which will log you in as the specified
	+administrative user.

	= Managing Accounts with the Web Console =

	To manage accounts from the web, login as an administrator account and go to
	##/people/## or click "People" on the homepage. Provided you're an admin,
	you'll see options to create or edit accounts.

	-= Managing Accounts from the Command Line =
	-
	-You can use ##scripts/user/add_user.php## to batch create accounts. Run it
	-like:
	-
	- $ ./add_user.php <username> <email> <realname> <admin>
	-
	-For example:
	-
	- $ ./add_user.php alincoln alincoln@logcabin.com 'Abraham Lincoln' tjefferson
	-
	-This will create a new ##alincoln## user and send them a "Welcome to
	-Phabricator" email from ##tjefferson## with instructions on how to log in and
	-set a password.
	-
	-= Configuring Facebook OAuth =
	-
	-You can configure Facebook OAuth to allow login, login and registration, or
	-nothing (the default). If registration is not allowed, users must have an
	-existing account in order to link a Facebook account to it, but can use
	-Facebook to login once the accounts are linked.
	-
	-To configure Facebook OAuth, create a new Facebook Application:
	-
	-https://developers.facebook.com/apps
	-
	-You should set these things in your application:
	-
	- - Site URL: Set this to your full domain with protocol, like
	- "##https://phabricator.example.com/##".
	- - Site Domain: Set this to the entire domain, like ##example.com##. You
	- might be able to get away with including the subdomain if you want to
	- scope more tightly.
	-
	-Once that is set up, edit your Phabricator configuration and set these keys:
	-
	- - facebook.auth-enabled: set this to ##true##.
	- - facebook.application-id: set to your Facebook application's ID. Make
	- sure you set this as a string.
	- - facebook.application-secret: set to your Facebook application's
	- secret key.
	- - facebook.registration-enabled: set this to ##true## to let users
	- register for your install with a Facebook account (this is a very open
	- setting) or ##false## to prevent users from registering with Facebook.
	- - facebook.auth-permanent: you can set this to prevent account unlinking.
	- It is unlikely you want to prevent it, but Facebook's internal install uses
	- this option since Facebook uses Facebook as its only auth mechanism.
	-
	-= Configuring GitHub OAuth =
	-
	-You can configure GitHub OAuth to allow login, login and registration, or
	-nothing (the default).
	-
	-To configure GitHub OAuth, create a new GitHub Application:
	-
	-https://github.com/settings/applications/new
	-
	-You should set these things in your application:
	-
	- - URL: Set this to the full domain with protocol, like
	- "##https://phabricator.example.com/##".
	- - Callback URL: Set this to your domain plus "##/oauth/github/login/##",
	- like "##https://phabricator.example.com/oauth/github/login/##".
	-
	-Once you've created an application, edit your Phabricator configuration and
	-set these keys:
	-
	- - github.auth-enabled: set this to ##true##.
	- - github.application-id: set this to your application/client ID.
	- - github.application-secret: set this to your application secret.
	- - github.registration-enabled: set to ##true## to let users register with
	- just GitHub credentials (this is a very open setting) or ##false## to
	- prevent users from registering. If set to ##false##, users may still link
	- existing accounts and use GitHub to login, they just can't create new
	- accounts.
	- - github.auth-permanent: set to ##true## to prevent unlinking Phabricator
	- accounts from GitHub accounts.
	-
	-= Configuring Google OAuth =
	-
	-You can configure Google OAuth to allow login, login and registration, or
	-nothing (the default).
	-
	-To configure Google OAuth, create a new Google "API Project":
	-
	-https://code.google.com/apis/console/
	+= Manually Creating New Accounts =

	-You don't need to enable any Services, just go to API Access, click
	-"Create an OAuth 2.0 client ID...", and configure these settings:
	+There are two ways to manually create new accounts: via the web UI using
	+the "People" application (this is easiest), or via the CLI using the
	+`accountadmin` binary (this has a few more options).

	- - Click More Options next to Authorized Redirect APIs and add the
	- full domain (with protocol) plus ##/oauth/google/login/## to the list.
	- For example, ##https://phabricator.example.com/oauth/google/login/##
	- - Click Create Client ID.
	+To use the CLI script, run:

	-Once you've created a client ID, edit your Phabricator configuration and set
	-these keys:
	+ phabricator/ $ ./bin/accountadmin

	- - google.auth-enabled: set this to ##true##.
	- - google.application-id: set this to your Client ID (from above).
	- - google.application-secret: set this to your Client Secret (from above).
	- - google.registration-enabled: set this to ##true## to let users register
	- with just Google credentials (this is a very open setting) or ##false## to
	- prevent users from registering. If set to ##false##, users may still link
	- existing accounts and use Google to login, they jus can't create new
	- accounts.
	- - google.auth-permanent: set this to ##true## to prevent unlinking
	- Phabricator accounts from Google accounts.
	+Some options (like setting passwords and changing certain account flags) are
	+only available from the CLI. You can also use this script to make a user
	+an administrator (if you accidentally remove your admin flag) or create an
	+administrative account.

	= Next Steps =

	Continue by:

	- returning to the @{article:Configuration Guide}.

File Metadata

Mime Type: text/x-diff
Expires: Wed, Dec 3, 4:41 AM (5 h, 42 m)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 433145
Default Alt Text: (165 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions