gerrybakker wrote:This hack works great on my Joomla 1.08 install.

sunburst - you're a Joomla hero - bring this to the attention of the other Joomla heros please and ramp this up to the attention it deserves. Maybe a loud noise from other heros will get their attention.

• user enters their email address and clicks reset password
• an email arrives with a hyperlink telling them to click it if they want to reset their password, and if they didnt request the reset to simply ignore the email
• when they click the reset link in the email, it takes them to a page where they can enter a new password

fatpat wrote:Nice hack!  Thanks!

The only "problem" that I see is someone resetting other peoples passwords.  Not really a big issue, but it could be a hassle.

Maybe a 2-stage reset would be better.

Request -> Email -> Confirm -> Reset

Cheers!
Patrick

MoJo2 wrote:I run 1.08 and i'm using comprofiler.
In my case this hack don't work.

Has somebody an Idea of how to change this when using comprofiler.

I think these files need to be edited beacuase they contain info about passrecovey
/www/components/comprofiler.html.php
/www/components/comprofiler.php

Thanks!

        if (!($user_id = $database->loadResult()) || !$checkusername || !$confirmEmail) {
              mosRedirect(sefRelToAbs("index.php?option=$option&task=lostPassword"),_ERROR_PASS );
        }

        if (!$user_id  || !$confirmEmail) {
                mosRedirect(sefRelToAbs("index.php?option=$option&task=lostPassword"),_ERROR_PASS );
        }

gypsydogg wrote:hmmm, I get no corrisponding username found....

function sendNewPass( $option ) {
        global $database, $Itemid;
        global $ueConfig,$_PLUGINS;

        // ensure no malicous sql gets past
        // $checkusername = trim( mosGetParam( $_POST, 'checkusername', '') );
        $confirmEmail = trim( mosGetParam( $_POST, 'confirmEmail', '') );

        //$database->setQuery( "SELECT id FROM #__users"
        //. "\nWHERE username='$checkusername' AND email='$confirmEmail'"
        //);
        $database->setQuery( "SELECT id FROM #__users
                              WHERE email='$confirmEmail'");
        $user_id = $database->loadResult();
        $database->setQuery( "SELECT username FROM #__users
                              WHERE email='$confirmEmail'");
        $checkusername = $database->loadResult();


        //if (!($user_id = $database->loadResult()) || !$checkusername || !$confirmEmail) {
        //      mosRedirect(sefRelToAbs("index.php?option=$option&task=lostPassword"),_ERROR_PASS );
        //}

        if (!$user_id  || !$confirmEmail) {
                mosRedirect(sefRelToAbs("index.php?option=$option&task=lostPassword"),_ERROR_PASS );
        }
(...)