Forgotten Password on the front-end

[joey102030]

I've got a login form working on the front-end of my site.

Is there an easy to way to replicate the back-end 'Forgotten Password' feature to use in the front-end?

[Marty Walker]

I got this from the forum here (probably Ryan) which might help.

    <?
    $showForm = true; 
    $email = $sanitizer->email($input->post->email);
    if($email) {
      $u = $users->get("email=$email"); 
      if($u->id) {
        // generate a random, temporary password
        $pass = '';
        $chars = 'abcdefghjkmnopqrstuvwxyz23456789'; // add more as you see fit
        $length = mt_rand(9,12); // password between 9 and 12 characters
        for($n = 0; $n < $length; $n++) $pass .= $chars[mt_rand(0, strlen($chars)-1)];
        $u->of(false);
        $u->tmp_pass = $pass; // populate a temporary pass to their profile
        $u->save();
        $u->of(true); 
        $message = "Your new password on the blah blah web site is: $pass\n";
        //$message .= "Please change it after you login.";
        mail($u->email, "Password reset", $message, "From: noreply@{$config->httpHost}"); 
        $page->body = "<p>An email has been dispatched to you with further instructions.</p>";
        $showForm = false;
      } else {
        $page->body = "<p>Sorry, account doesn't exist or doesn't have an email.</p>";
      }
    }

    if($showForm) $page->body .= "
      <h2>Reset your password</h2>
      <form action='./' method='post'>
      <label>E-Mail <input type='email' name='email'></label>
      <input type='submit' value='Submit'>
      <p class='spam-check'>Please check your spam folder in case this email doesn't appear within 10 minutes.</p>
      </form>
    ";

    // include the main HTML/markup template that outputs at least $page->body in an HTML document
    echo $page->body;

    ?>

[joey102030]

Thanks Marty

I can see how that works, but I'm really not keen on outputting raw passwords to the screen or an email.

I'd really like to be able to replicate the back-end 'Forgotten Password' feature somehow.

I've had a look in the ProcessForgotPassword file and there doesn't appear to be anything too complex, I'm just not entirely sure how it's bound to the back-end login in such a way to be invoked from http://<hostname>/<admin>/?forgot=1

[joey102030]

OK I feel like a n00b now!

This simple bit of code seems to work anywhere in the front-end:

if ($this->modules->isInstalled('ProcessForgotPassword')) echo $this->modules->get("ProcessForgotPassword")->execute();

Obviously it should be attached to a link and used in the same context as in the backend... but It generates the bare unstyled forms, and seems to handle all the functionality perfectly.

[quickjeff]

@Joey, does this prevents a user from being directed to the backed as an admin? Is it stable?

Thanks!

[joey102030]

It's part of the core, so no question of it being stable.

I've not had a chance to integrate it properly, but you can see for yourself in the ProcessForgotPassword.php it keeps you on the same page so in theory can be used in any part of the site.

[quickjeff]

Hmmm I will have to give it a try but I want to prevent the front end user from ever coming across the back end admin.

[Manaus]

Is there a way to translate the prompt to action generated by this code?

Thanks!