=== modified file 'htdocs/preferences.php'
--- htdocs/preferences.php	2012-03-22 21:52:36 +0000
+++ htdocs/preferences.php	2012-04-18 15:55:18 +0000
@@ -63,7 +63,7 @@
     $res = User::updateEmail($usr_id);
     $tpl->assign('update_email_result', $res);
 } elseif (@$_POST["cat"] == "update_password") {
-    $res = User::updatePassword($usr_id);
+    $res = Auth::updatePassword($usr_id, $_POST['new_password'], $_POST['confirm_password']);
     $tpl->assign('update_password_result', $res);
 }
 

=== modified file 'init.php'
--- init.php	2012-03-22 21:52:36 +0000
+++ init.php	2012-04-18 15:55:18 +0000
@@ -136,6 +136,10 @@
     define('APP_FULLTEXT_SEARCH_CLASS', 'mysql_fulltext_search');
 }
 
+if (!defined('APP_AUTH_BACKEND')) {
+    define('APP_AUTH_BACKEND', 'mysql_auth_backend');
+}
+
 if (!defined('APP_DEFAULT_ASSIGNED_EMAILS')) {
     define('APP_DEFAULT_ASSIGNED_EMAILS', 1);
 }

=== added directory 'lib/eventum/auth'
=== added file 'lib/eventum/auth/class.abstract_auth_backend.php'
--- lib/eventum/auth/class.abstract_auth_backend.php	1970-01-01 00:00:00 +0000
+++ lib/eventum/auth/class.abstract_auth_backend.php	2012-04-08 14:17:17 +0000
@@ -0,0 +1,77 @@
+<?php
+/* vim: set expandtab tabstop=4 shiftwidth=4 encoding=utf-8: */
+// +----------------------------------------------------------------------+
+// | Eventum - Issue Tracking System                                      |
+// +----------------------------------------------------------------------+
+// | Copyright (c) 2012 Eventum Team.                                     |
+// |                                                                      |
+// | This program is free software; you can redistribute it and/or modify |
+// | it under the terms of the GNU General Public License as published by |
+// | the Free Software Foundation; either version 2 of the License, or    |
+// | (at your option) any later version.                                  |
+// |                                                                      |
+// | This program is distributed in the hope that it will be useful,      |
+// | but WITHOUT ANY WARRANTY; without even the implied warranty of       |
+// | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the        |
+// | GNU General Public License for more details.                         |
+// |                                                                      |
+// | You should have received a copy of the GNU General Public License    |
+// | along with this program; if not, write to:                           |
+// |                                                                      |
+// | Free Software Foundation, Inc.                                       |
+// | 59 Temple Place - Suite 330                                          |
+// | Boston, MA 02111-1307, USA.                                          |
+// +----------------------------------------------------------------------+
+// | Authors: Elan Ruusamäe <glen@delfi.ee>                               |
+// +----------------------------------------------------------------------+
+//
+
+
+/**
+ * Abstract class for auth backend
+ */
+abstract class Abstract_Auth_Backend
+{
+    /**
+     * Checks whether the provided password match against the email
+     * address provided.
+     *
+     * @access  public
+     * @param   string $email The email address to check for
+     * @param   string $password The password of the user to check for
+     * @return  boolean
+     */
+    public function verifyPassword($email, $password)
+    {
+        return false;
+    }
+
+    /**
+     * Method used to update the account password for a specific user.
+     *
+     * @access  public
+     * @param   integer $usr_id The user ID
+     * @param   string  $password The password.
+     * @return  boolean true if update worked, false otherwise
+     */
+    function updatePassword($usr_id, $password)
+    {
+        return false;
+    }
+
+    /**
+     * Hashes the password according to APP_HASH_TYPE constant
+     *
+     * @param   string $password The plain text password
+     * @return  string The hashed password
+     */
+    public static function hashPassword($password)
+    {
+        if (APP_HASH_TYPE == 'MD5-64') {
+            return base64_encode(pack('H*', md5($password)));
+        } else {
+            // default to md5
+            return md5($password);
+        }
+    }
+}

=== added file 'lib/eventum/auth/class.mysql_auth_backend.php'
--- lib/eventum/auth/class.mysql_auth_backend.php	1970-01-01 00:00:00 +0000
+++ lib/eventum/auth/class.mysql_auth_backend.php	2012-04-08 14:24:50 +0000
@@ -0,0 +1,77 @@
+<?php
+/* vim: set expandtab tabstop=4 shiftwidth=4 encoding=utf-8: */
+// +----------------------------------------------------------------------+
+// | Eventum - Issue Tracking System                                      |
+// +----------------------------------------------------------------------+
+// | Copyright (c) 2012 Eventum Team.                                     |
+// |                                                                      |
+// | This program is free software; you can redistribute it and/or modify |
+// | it under the terms of the GNU General Public License as published by |
+// | the Free Software Foundation; either version 2 of the License, or    |
+// | (at your option) any later version.                                  |
+// |                                                                      |
+// | This program is distributed in the hope that it will be useful,      |
+// | but WITHOUT ANY WARRANTY; without even the implied warranty of       |
+// | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the        |
+// | GNU General Public License for more details.                         |
+// |                                                                      |
+// | You should have received a copy of the GNU General Public License    |
+// | along with this program; if not, write to:                           |
+// |                                                                      |
+// | Free Software Foundation, Inc.                                       |
+// | 59 Temple Place - Suite 330                                          |
+// | Boston, MA 02111-1307, USA.                                          |
+// +----------------------------------------------------------------------+
+// | Authors: Elan Ruusamäe <glen@delfi.ee>                               |
+// +----------------------------------------------------------------------+
+//
+
+
+/**
+ * Abstract class for auth backend
+ */
+class Mysql_Auth_Backend extends Abstract_Auth_Backend
+{
+    /**
+     * Checks whether the provided password match against the email
+     * address provided.
+     *
+     * @access  public
+     * @param   string $email The email address to check for
+     * @param   string $password The password of the user to check for
+     * @return  boolean
+     */
+    public function verifyPassword($email, $password)
+    {
+        $usr_id = User::getUserIDByEmail($email, true);
+        $user = User::getDetails($usr_id);
+        return $user['usr_password'] == self::hashPassword($password);
+    }
+
+    /**
+     * Method used to update the account password for a specific user.
+     *
+     * @access  public
+     * @param   integer $usr_id The user ID
+     * @param   string  $password The password.
+     * @return  boolean
+     */
+    function updatePassword($usr_id, $password)
+    {
+        $stmt = "UPDATE
+                    " . APP_DEFAULT_DB . "." . APP_TABLE_PREFIX . "user
+                 SET
+                    usr_password='" . self::hashPassword($password) . "'
+                 WHERE
+                    usr_id=" . Misc::escapeInteger($usr_id);
+        $res = DB_Helper::getInstance()->query($stmt);
+        if (PEAR::isError($res)) {
+            Error_Handler::logError(array($res->getMessage(), $res->getDebugInfo()), __FILE__, __LINE__);
+            return false;
+        }
+
+        # NOTE: this will say updated failed if password is identical to old one
+        $updated = DB_Helper::getInstance()->affectedRows();
+        return $updated > 0;
+    }
+}

=== modified file 'lib/eventum/class.auth.php'
--- lib/eventum/class.auth.php	2012-03-22 21:52:36 +0000
+++ lib/eventum/class.auth.php	2012-04-18 15:55:19 +0000
@@ -394,13 +394,31 @@
      */
     function isCorrectPassword($email, $password)
     {
-        $usr_id = User::getUserIDByEmail($email, true);
-        $user = User::getDetails($usr_id);
-        if ($user['usr_password'] != self::hashPassword($password)) {
-            return false;
-        } else {
-            return true;
-        }
+        return self::getAuthBackend()->verifyPassword($email, $password);
+    }
+
+    /**
+     * Method used to update the account password for a specific user.
+     *
+     * @access  public
+     * @param   integer $usr_id The user ID
+     * @param   boolean $send_notification Whether to send the notification email or not
+     * @return  integer 1 if the update worked, -1 otherwise
+     */
+    function updatePassword($usr_id, $password, $password_confirm, $send_notification = false)
+    {
+        if ($password != $password_confirm) {
+            return -2;
+        }
+
+        $res = self::getAuthBackend()->updatePassword($usr_id, $password);
+        if (!$res) {
+            return -1;
+        }
+        if ($send_notification) {
+            Notification::notifyUserPassword($usr_id, $password);
+        }
+        return 1;
     }
 
 
@@ -520,24 +538,6 @@
         $_COOKIE[APP_PROJECT_COOKIE] = base64_encode(serialize($cookie));
     }
 
-
-    /**
-     * Hashes the password according to APP_HASH_TYPE constant
-     *
-     * @param   string $password The plain text password
-     * @return  string The hashed password
-     */
-    public static function hashPassword($password)
-    {
-        if (APP_HASH_TYPE == 'MD5-64') {
-            return base64_encode(pack('H*',md5($password)));
-        } else {
-            // default to md5
-            return md5($password);
-        }
-    }
-
-
     /**
      * Sets a cookie in the browser
      *
@@ -554,4 +554,20 @@
             setcookie($name, $value, $expiration, APP_COOKIE_URL, APP_COOKIE_DOMAIN);
         }
     }
+
+    /**
+     * @static
+     * @return Abstract_Auth_Backend
+     */
+    private static function getAuthBackend()
+    {
+        static $instance = false;
+
+        if ($instance == false) {
+            require_once APP_INC_PATH . "/auth/class." . APP_AUTH_BACKEND. ".php";
+            $class = APP_AUTH_BACKEND;
+            $instance = new $class();
+        }
+        return $instance;
+    }
 }

=== modified file 'lib/eventum/class.user.php'
--- lib/eventum/class.user.php	2012-03-22 21:52:36 +0000
+++ lib/eventum/class.user.php	2012-04-18 15:55:19 +0000
@@ -389,7 +389,6 @@
         $mail->send($setup["smtp"]["from"], $info["usr_email"], APP_SHORT_NAME . ": New Password - Confirmation Required");
     }
 
-
     /**
      * Method used to confirm the request of a new password and send an email
      * to the user with the new random password.
@@ -402,9 +401,8 @@
     {
         $usr_id = self::getUserIDByEmail($email);
         // create the new password
-        $_POST["new_password"] = substr(md5(microtime() . uniqid("")), 0, 12);
-        $_POST["confirm_password"] = $_POST["new_password"];
-        self::updatePassword($usr_id, true);
+        $password = substr(md5(microtime() . uniqid("")), 0, 12);
+        Auth::updatePassword($usr_id, $password, $password, true);
     }
 
 
@@ -928,39 +926,6 @@
         }
     }
 
-
-    /**
-     * Method used to update the account password for a specific user.
-     *
-     * @access  public
-     * @param   integer $usr_id The user ID
-     * @param   boolean $send_notification Whether to send the notification email or not
-     * @return  integer 1 if the update worked, -1 otherwise
-     */
-    function updatePassword($usr_id, $send_notification = FALSE)
-    {
-        if ($_POST['new_password'] != $_POST['confirm_password']) {
-            return -2;
-        }
-        $stmt = "UPDATE
-                    " . APP_DEFAULT_DB . "." . APP_TABLE_PREFIX . "user
-                 SET
-                    usr_password='" . Auth::hashPassword($_POST["new_password"]) . "'
-                 WHERE
-                    usr_id=" . Misc::escapeInteger($usr_id);
-        $res = DB_Helper::getInstance()->query($stmt);
-        if (PEAR::isError($res)) {
-            Error_Handler::logError(array($res->getMessage(), $res->getDebugInfo()), __FILE__, __LINE__);
-            return -1;
-        } else {
-            if ($send_notification) {
-                Notification::notifyUserPassword($usr_id, $_POST["new_password"]);
-            }
-            return 1;
-        }
-    }
-
-
     /**
      * Method used to update the account full name for a specific user.
      *

