Skip to:
Content
Pages
Categories
Search
Top
Bottom

Forcing Password Reset (not *don't want to*)

  • Hopefully I did not miss this somewhere else…

    The one thing that bothers me is the lack of “security” around an email address change (besides the system allowing duplicates). I’d like to force a password change (generate a random) which is emailed to the new address to thwart ill intent.

    I see the functions

    function bb_reset_email( $user_login ) {
    function bb_reset_password( $key ) {

    but this hinges upon the

    If you don't want to reset your password, just ignore this email. Thanks!

    which the exact thing I want to avoid.

    What would it take to verify the value of newpwdkey

    bb_update_usermeta( $user->ID, 'newpwdkey', $resetkey );

    and noting if there is a value stored, disable the login until bb_reset_password is executed via the link in the email.

    *i’m ok with hacking the core files for the time being and merging with upgrades with my own markers.

Viewing 4 replies - 1 through 4 (of 4 total)
  • ok, nevermind – figured things out. I found a bb_break_password function but since that is hooked into the blocked role. I just made a new one with a different $secret and cleared the auth cookie after changing the email (also sent out an email to the old address notifying of the change and initiated bb_reset_email on the new email)

    it would be great if a feature like this was incorporated into bbPress for the future. :)


    Michael3185
    Member

    @michael3185

    @nuprn1; Could you show exactly what you did please? I’m on 0.9.0.5, and would prefer a password reset and notification if someone changes their email. As well as security, it’s because some of the users on one forum I built have no idea what they’re doing on a PC. They’ve given me wrong emails for Admin registrations, and done all sorts of things which make me realise that they may break their email at some later stage too.

    A plugin for this would be good, if it can be done fairly easily, though I don’t mind hacking my core files as 0.9 upgrades will probably be few and far between in the future.

    [edit]

    Just had another thought. The forum in question will only have around 60 – 70 members once fully used, as it’s for a small service provider who restrict access. I could just disable the email field in the profile I guess, and let them email or PM me to change it if they want to. Any ideas on this folks..?

    Sure… but be forewarned. i’m not familiar with php whatsoever and the bbPress structure. (so i’m sure i violated something) this is on 1.0. Not sure if this can be made into a plug-in or not, I have yet to read up on how to create those and the filter/hook stuff.

    (i have a small community ~1000 when all said and done – but some are savvy with firebug would just edit the form fields if disabled)

    profile-edit.php in the main root – everything labeled CHANGED

    // Instantiate the error object

    $errors = new WP_Error;

    if ( ‘post’ == strtolower($_SERVER) ) {

    $_POST = stripslashes_deep( $_POST );

    bb_check_admin_referer( ‘edit-profile_’ . $user_id );

    // Fix the URL before sanitizing it

    $user_url = bb_fix_link( $_POST );

    // Sanitize the profile info keys and check for missing required data

    foreach ( $profile_info_keys as $key => $label ) {

    $$key = apply_filters( ‘sanitize_profile_info’, $_POST[$key], $key, $_POST[$key] );

    if ( !$$key && $label[0] == 1 ) {

    $errors->add( $key, sprintf( __( ‘%s is required.’ ), esc_html( $label[1] ) ) );

    $$key = false;

    }

    }

    // Find out if we have a valid email address

    if ( isset( $user_email ) && !$user_email = is_email( $user_email ) ) {

    $errors->add( ‘user_email’, __( ‘Invalid email address’ ), array( ‘data’ => $_POST ) );

    }

    //CHANGED – added for duplicate email check on profile update

    if (isset( $user_email )) {

    if(changed_no_duplicate_email_update_user($user_email, $user->ID)) {

    $bad_input = true;

    $$key = false;

    $errors->add( ‘user_email’, __( ‘Email address already in use’ ), array( ‘data’ => $_POST ) );

    }

    }

    //ENDCHANGED

    // Deal with errors for users who can edit others data

    if ( bb_current_user_can(‘edit_users’) ) {

    // If we are deleting just do it and redirect

    if ( isset($_POST) && $_POST && $bb_current_id != $user->ID ) {

    bb_delete_user( $user->ID );

    wp_redirect( bb_get_uri(null, null, BB_URI_CONTEXT_HEADER) );

    exit;

    }

    // Get the user object

    $user_obj = new BP_User( $user->ID );

    // Store the new role

    $role = $_POST;

    // Deal with errors with the role

    if ( !isset($wp_roles->role_objects[$role]) ) {

    $errors->add( ‘role’, __( ‘Invalid Role’ ) );

    } elseif ( !bb_current_user_can( ‘keep_gate’ ) && ( ‘keymaster’ == $role || ‘keymaster’ == $user_obj->roles[0] ) ) {

    $errors->add( ‘role’, __( ‘You are not the Gate Keeper.’ ) );

    } elseif ( ‘keymaster’ == $user_obj->roles[0] && ‘keymaster’ != $role && $bb_current_id == $user->ID ) {

    $errors->add( ‘role’, __( ‘You are Keymaster, so you may not demote yourself.’ ) );

    }

    // Sanitize the profile admin keys and check for missing required data

    foreach ( $profile_admin_keys as $key => $label ) {

    if ( isset( $$key ) )

    continue;

    $$key = apply_filters( ‘sanitize_profile_admin’, $_POST[$key], $key, $_POST[$key] );

    if ( !$$key && $label[0] == 1 ) {

    $errors->add( $key, sprintf( __( ‘%s is required.’ ), esc_html( $label[1] ) ) );

    $$key = false;

    }

    }

    // Create variable for the requested roles

    foreach ( $assignable_caps as $cap => $label ) {

    if ( isset($$cap) )

    continue;

    $$cap = ( isset($_POST[$cap]) && $_POST[$cap] ) ? 1 : 0;

    }

    }

    // Deal with errors generated from the password form

    if ( bb_current_user_can( ‘change_user_password’, $user->ID ) ) {

    if ( ( !empty($_POST) || !empty($_POST) ) && $_POST !== $_POST ) {

    $errors->add( ‘pass’, __( ‘You must enter the same password twice.’ ) );

    } elseif( !empty($_POST) && !bb_current_user_can( ‘change_user_password’, $user->ID ) ) {

    $errors->add( ‘pass’, __( “You are not allowed to change this user’s password.” ) );

    }

    }

    // If there are no errors then update the records

    if ( !$errors->get_error_codes() ) {

    do_action(‘before_profile_edited’, $user->ID);

    //CHANGED – did we reset the email?

    $changed_do_email_reset = false;

    //ENDCHANGED

    if ( bb_current_user_can( ‘edit_user’, $user->ID ) ) {

    //CHANGED- if user updates email address – generate new password and email

    if ($user->user_email != $user_email) {

    $changed_do_email_reset = true;

    $changed_old_email = $user->user_email;

    }

    //ENDCHANGED

    // All these are always set at this point

    bb_update_user( $user->ID, $user_email, $user_url, $display_name );

    // Add user meta data

    foreach( $profile_info_keys as $key => $label ) {

    if ( ‘display_name’ == $key || ‘ID’ == $key || strpos($key, ‘user_’) === 0 )

    continue;

    if ( $$key != ” || isset($user->$key) )

    bb_update_usermeta( $user->ID, $key, $$key );

    }

    }

    if ( bb_current_user_can( ‘edit_users’ ) ) {

    if ( !array_key_exists($role, $user->capabilities) ) {

    $user_obj->set_role($role); // Only support one role for now

    if ( ‘blocked’ == $role && ‘blocked’ != $old_role )

    bb_break_password( $user->ID );

    elseif ( ‘blocked’ != $role && ‘blocked’ == $old_role )

    bb_fix_password( $user->ID );

    }

    foreach( $profile_admin_keys as $key => $label )

    if ( $$key != ” || isset($user->$key) )

    bb_update_usermeta( $user->ID, $key, $$key );

    foreach( $assignable_caps as $cap => $label ) {

    if ( ( !$already = array_key_exists($cap, $user->capabilities) ) && $$cap) {

    $user_obj->add_cap($cap);

    } elseif ( !$$cap && $already ) {

    $user_obj->remove_cap($cap);

    }

    }

    }

    //CHANGED – send confirmation emails, log them out

    if ($changed_do_email_reset) {

    $send_key_result = bb_reset_email( $user->user_login );

    if ( is_wp_error( $send_key_result ) )

    $error = $send_key_result->get_error_message();

    if ($changed_old_email) {

    $mail_result = bb_mail( $changed_old_email, bb_get_option(‘name’) . ‘: ‘ . __(‘Email Address Updated’), “Your email address has been updated and a confirmation message has been sent. Thanks!” );

    if (!$mail_result) {

    new WP_Error(‘sending_mail_failed’, __(‘The email notifying an email address change could not be sent.’));

    }

    }

    //kill their current session and break the password so they can’t log in until a reset.

    if ( bb_get_current_user_info( ‘ID’ ) == $user->ID ) {

    changed_break_password( $user->ID );

    bb_clear_auth_cookie();

    }

    //ENDCHANGED

    } else if ( bb_current_user_can( ‘change_user_password’, $user->ID ) && !empty($_POST) ) {

    $_POST = addslashes($_POST);

    bb_update_user_password( $user->ID, $_POST );

    if ( bb_get_current_user_info( ‘ID’ ) == $user->ID ) {

    bb_clear_auth_cookie();

    bb_set_auth_cookie( $user->ID );

    }

    }

    do_action(‘profile_edited’, $user->ID);

    //CHANGED – lets fire off a message on the template page to explain what we did

    if ($changed_do_email_reset) {

    wp_redirect( add_query_arg( ‘emailupdated’, ‘true’, get_user_profile_link( $user->ID ) ) );

    //ENDCHANGED

    } else {

    wp_redirect( add_query_arg( ‘updated’, ‘true’, get_user_profile_link( $user->ID ) ) );

    }

    exit;

    }

    }

    then two helper functions

    function changed_no_duplicate_email_update_user($email, $id) {

    if ($email && $id) {

    global $bbdb;

    if ($bbdb->get_row($bbdb->prepare("SELECT ID FROM $bbdb->users WHERE user_email = %s AND ID <> %d ", $email, $id))) {

    return true;

    } else {

    return false;

    }

    }

    }

    function changed_break_password( $user_id ) {

    global $bbdb;

    $user_id = (int) $user_id;

    if ( !$user = bb_get_user( $user_id ) )

    return false;

    $secret = substr(bb_hash( ‘changed_break_password’ ), 0, 13);

    if ( false === strpos( $user->user_pass, ‘—’ ) )

    return $bbdb->query( $bbdb->prepare(“UPDATE $bbdb->users SET user_pass = CONCAT(user_pass, ‘changed’, %s) WHERE ID = %d”, $secret, $user_id) );

    else

    return true;

    }


    Michael3185
    Member

    @michael3185

    Many thanks. I’ll give it a try.

Viewing 4 replies - 1 through 4 (of 4 total)

You must be logged in to reply to this topic.