ProcessWire 3.0.103 core updates

ProcessWire 3.0.103

This week we've got some really nice upgrades to three core modules: SessionHandlerDB, ProcessForgotPassword and FieldtypeComments. This post covers all the details.

Last week we didn't have a blog post for ProcessWire 3.0.103, but did have a brief forum post. If you'd like to read that, it's located here.

New feature in Session Database core module

GitHub user @kixe (Christoph Thelen) submitted a PR that adds a nice new feature to the core SessionHandlerDB module. This particular feature enables an option to prevent parallel sessions. That means preventing the same user from having more than one login at a time.

Lets say that you were logged in to your ProcessWire site at work, and forgot to logout before leaving for the evening. You could login at home, and your session at work would automatically be logged out, since only one login session would be allowed at a time. Depending on your case, this may be a nice addition for security, or just for good housekeeping. But it's another addition to the SessionHandlerDB module that makes it worthwhile to consider using over the default file-based sessions.

Since this module is already included with the core, it can be installed just by going to Modules > Core > Session > Session Handler Database. You might already know this, but when the SessionHandlerDB module is installed, you can monitor active user sessions from Setup > Sessions, in your admin, which is another useful aspect of this module.

Major update to “forgot password” core module

Not much has changed in the ProcessForgotPassword module since the early versions of ProcessWire 2.x. And that's been fine, because it is pretty focused in purpose and does its job well. But lately I've been using this module more and more on the front-end of sites (in addition to just the admin) and have been wanting some more options for it, regardless of where it is used. This week a whole lot of updates went in place. Here's a summary:

  • Ability to use email address rather than username, to initiate a password reset request.

  • Flood detection and control, preventing someone from initiating lots of requests.

  • Optional logging of all activity to Setup > Logs > forgot-password.

  • Ability to make user confirm values of other fields on a User account before password can be reset.

  • Separate token and confirmation code for even more security in confirming a request by email.

  • Ability to specify roles that are allowed to reset their password, as well as the ability to specify roles that are blocked from doing this. For instance, you could enable the feature for authenticated users of your site (members) while disabling it for superusers.

  • Improved front-end support, like when used with LoginRegister module or similar. Now configuration options can make it render notifications inline, rather than those used by the PW admin.

  • If a reset request can't be completed for some reason on a valid account, it now emails the user the reason why.

  • It now sends an HTML email for password reset requests (with a plain text alternate). The email can also be customized with newly added hooks.

  • In addition to a secondary verification code/token (mentioned earlier) other new security features have been added. For instance, in the final step, if the user fails to confirm the verification code, or any other configured confirmation fields, for more than 2 times, the reset request will be abandoned.

To use this latest version of the ProcessForgotPassword module, go to Modules > Refresh, and then Modules > Configure > ProcessForgotPassword. Review and customize the configuration options according to your preferences, and save.

Upgrades to comments search engine

I'm currently working on a client project that uses ProcessWire's comments field pretty extensively in the site. With thousands of comments in the system, the site needed a whole separate search engine dedicated to comments. We've had the FieldtypeComments::find() method since around ProcessWire version 2.2, but it was fairly limited in what it could do. This particular find() method searches all comments in a particular site, regardless of what page they live on.

ProcessWire 3.0.103 upgrades the comments search engine so that it is a lot more capable, and works a lot more like $pages->find(). Below are some of the additions, along with examples of them. In all of the examples, our $field variable is a comments field, i.e.

$field = $fields->get('comments'); 

1. Ability to search comment text quickly using fulltext index.

$a = $field->type->find("text~=hello world"); 

The above would return all comments containing the words "hello" and "world" somewhere in the comment. You can use the ~= (contains words), %= (phrase like), *= (contains phrase), ^= (starts with), or $= (ends with) operators. Here's another example below:

$a = $field->type->find("text*=skyscraper, upvotes>0");  

2. Ability to sort comments by more than one property.

$a = $field->type->find("sort=-stars, sort=-created"); 

Previously you could only sort by one property at a time. The above would return all comments sorted by stars (highest to lowest) and second by date created. Meaning, the result would contain all 5-star comments newest-to-oldest, then all 4-star comments newest-to-oldest, etc.

3. Ability to match comments from many page properties (like page references):

$sailing = $pages->get("/blog/topics/sailing/");
$a = $field->type->find("page.topics=$sailing"); 

The above would return all comments likely related to sailing, because they would be comments on pages that have a Page reference field called "topics" that has "sailing" selected.

4. Ability to use OR values on most properties

$a = $field->type->find("stars=4|5");

The above would return all comments with 4 or 5 stars selected. That could of course also be matched with "stars>=4".

5. Ability to match based on comment status keywords:

$a = $field->type->find("status=pending");

The above would return all comments with a "pending" status. Note that by default, on the front-end, if you don't specify a status, the find() method returns only approved comments. So if you want to return pending and/or spam comments too, you have to specify that.

While this greatly increases the capabilities of our comments search engine, please note that it's not nearly as full featured as our pages finding engine. There's still plenty of room for improvements here, so there will likely be additional tweaks as I continue working on this

Also coming up soon will be some updates to the ProcessCommentsManager module, adding some improvements to take advantage of the features mentioned above.

Thanks for reading and have a great weekend! Enjoy reading the always awesome ProcessWire Weekly.

Comments

  • Horst

    Horst

    • 2 years ago
    • 60
    The "forgot password" additions are so cool!
    Many thanks!
  • Roman

    Roman

    • 1 year ago
    • 00
    Many thanks for all the work!

    Session handling: For some frontsite usecases (with Login/Register/Profile-Module) it would be great to define the allowed max. parallel sessions of a user, not only disallowing any parallel session.

 

PrevProcessWire 3.0.101 core updates

2

This week's version of ProcessWire on the dev branch continues resolution of GitHub issue reports, and it also adds a new text truncation function to our $sanitizer API, something requested from our requests repository. More 

NextProcessWire 3.0.105 core updates

4

This latest version on the dev branch adds a new site profile to the core, adds useful new functions to our $mail API variable, and makes significant enhancements to our $sanitizer API variable.  More 

Twitter updates

  • This post covers a few of the bigger updates in ProcessWire 3.0.154+3.0.155. This includes new live replacement of text in core and modules, a new method for creating canonical URLs, and some major upgrades to our input->urlSegment() method! More
    24 April 2020
  • A brief look at what's new in ProcessWire 3.0.154 in this forum post: More
    17 April 2020
  • This week we’ve got a few new and interesting core updates in progress, though none quite ready to release just yet. So rather than releasing version 3.0.154 today, I thought we'd instead take a brief look at what’s coming over the next few weeks… More
    3 April 2020

Latest news

  • ProcessWire Weekly #311
    In the 311th issue of ProcessWire Weekly we're going to talk a bit about the latest dev versions of ProcessWire, introduce a couple of new third party modules, and more. Read on!
    Weekly.pw / 25 April 2020
  • ProcessWire 3.0.154 and 3.0.155 core updates
    This post covers a few of the bigger updates in ProcessWire 3.0.154 and 3.0.155 on the dev branch. This includes a new function for live replacement of text in core and modules, a new method for creating canonical URLs, and some major upgrades to our $input->urlSegment() method that I think you’ll like!
    Blog / 24 April 2020
  • Subscribe to weekly ProcessWire news

“Yesterday I sent the client a short documentation for their ProcessWire-powered website. Today all features already used with no questions. #cmsdoneright—Marc Hinse, Web designer/developer