forgot backend password, how do you reset?!

[danielholanda]

Hello,

I see that the backend of processwire is simple. I like that but... I've forgotton my email for my backend project I'm creating locally with MAMP. Simple but... where is the button such as, "forgot password". I suppose I missing something obviuos but I cannot find it in the display neither in google or in these forums.

So,

How do you reset/retieve your password from you backend of processwire?

Greetings,

Dani

[diogo]

Have a look at this thread http://processwire.com/talk/topic/490-how-to-reset-your-password-how-to-enable-the-forgot-password-function/page__hl__%2Bforgot+%2Bpassword

[Soma]

There's a Password Forgot module but not installed by default.

I think only solution would be to install new, or do this:

Create a /tool.php in the same directory as the /index.php in the root of PW install.

Paste in this code:

<?php
include("index.php");
wire("modules")->get("ProcessForgotPassword");

Save it and if necessary upload it to your server. Remember the file as you'll need it shortly.

Now call it from the browser http://yourdomain.com/tool.php and the Module will get installed and a Password forgot link should show up on the login screen.

Delete the tool.php.

Edit: You can, using this technique, also set a new password for the admin, see on the link Diogo posted.

[danielholanda]

Thanks... Luckily I dodnt do too much, I will resintall and activate module. There should be a PDF with instructions and one of the first should be reset password module. If you have a lot of work already done... ufffff I would get mad. Thanks for your answers

[Soma]

As being said you can set a new password through a script, install the module through the php script or if nothing helps reinstall (of course only if you haven't done anything yet). So no biggy at all if you have access to your files, which I assume you should have. This would be a matter of 1 minute and no need to reinstall.

So no need to going mad even if you developed for days on it.

The password is something you shouldn't forget, and the forgot password module isn't installed by default for security reasons.

[ryan]

You can always reset your password just by pasting this temporarily into any one of your templates, and then viewing a page that uses the template:

$u = $users->get('admin'); // or whatever your username is
$u->of(false); 
$u->pass = 'your-new-password';
$u->save();

[mike77]

BTW, what is the location of login/password in the database? I didn't go into it but it would be practical to know.

[Pete]

I think from memory that the table is called users (can't check from my phone) but the password would of course be encrypted so that wouldn't do you much good if you we're intending to reset it there.

[ryan]

Passwords are in a table called field_password. They are hashed and salted, and not reversible, so no way to set or change them without going directly through the API.

[apeisa]

Little OT: is it possible to use password field on other templates?

[Soma]

Where getting a little old!

It's field_pass not field_password

And yes you can put a "password" field in other templates

[apeisa]

Soma: through API or with advanced mode?

[Soma]

Add new field, select "password" field and enter name..

Ahhh you mean so it get's used as a real password field with encryption? I don't think but should be possible to add functionality through a module?

Edit: look normal so far, it works without anything!

[apeisa]

Ah, brilliant! I tried to add the existing password field into a template without any luck on that Never realized that I could create new password fields, but it is indeed possible! Thanks Soma! Of course need to know how to calculate the password hash (to compare the one that gets added into a db), but that should be easy enough.

[Soma]

you can use the $page->passwordfield->match("somepasswordstring") function to compare hashs.

[tuomassalo]

Passwords are in a table called field_password. They are hashed and salted, and not reversible, so no way to set or change them without going directly through the API.

But... if you just need to reset a password and using a Mysql prompt feels easier than adding temporary .php files, this brutal SQL clause sets admin's password to 'admin1': 

UPDATE field_pass f, pages p, templates t SET f.data='rO65UGbDmOQYVanmOznTp1zJMhM1p2e', salt='$2y$11$Y89v0EVaoVB7Vg/Yiq7xqO' WHERE f.pages_id=p.id AND p.name="admin" AND p.templates_id=t.id AND t.name="user";

Just remember to change it later on.

Update: this doesn't work since PW also uses a static salt in config.

[apeisa]

Tuomas, thanks for your post and welcome to forums! Does that work universally, since there is another salt at filesystem (site/config.php)?

https://github.com/ryancramerdesign/ProcessWire/blob/master/install.php#L610

[tuomassalo]

Apeisa: thanks for the insight. Fixed my previous comment.

[siilak]

Really love this function