Just a small bit of code to explain the use of password reset request tokens.
If a user forgets their password there are numerous methods of helping them.
I suggest using bb_users_passwd_reset_request_tokens as this method allows the user to verify their reset before actually triggering it.
The approach would be something like this:
if($global[reset_password]){
$u=new bb_users();
$u=$u->get(array("where"=>"
name=".sqlstr($global[reset_password])." OR email=".sqlstr($global[reset_password])."
"));
if($u){
$new_token=new bb_users_passwd_reset_request_tokens();
$new_token=$new_token->add(array(
"do_not_redirect"=>"true",
"this_class"=>"bb_users_passwd_reset_request_tokens",
"fields"=>array("userISbb_usersID"=>$u[_id])));
$reload_token=new bb_users_passwd_reset_request_tokens();
$reload_token=$reload_token->get(array("_id"=>$new_token[_id]));
bb_sendmail(array("subject"=>"Your Password Reset Token - ".date("YmdHis"),
"from"=>"some@email.com",
"to"=>$u[email],
"body"=>
"
<html>
<head>
</head>
<body>
<table align=center width=640>
<tr>
<td align=left>
Dear ".$u[first_name].",<br>
<br>
You have requested a password reset token.<br>
<br>
Click on this link to reset your password:<br>
<br>
http://".$_SERVER[HTTP_HOST]."/?somepage&global[pwrs]=$reload_token[_apikey]
<br>
<br>
from<br>
Support
</td>
</tr>
</table>
</body>
</html>
"));
}else{
//error no user found for email
}
}
Then, the link they click on will trigger:
if($global[pwrs]){
$reload_token=new bb_users_passwd_reset_request_tokens();
$reload_token=$reload_token->get(array("_apikey"=>$global[pwrs]));
if($reload_token){
$u=new bb_users();
$u=$u->get(array("_id"=>$reload_token[userISbb_usersID]));
if($u){
$alphabet = "abcdefghijklmnopqrstuwxyzABCDEFGHIJKLMNOPQRSTUWXYZ0123456789";
$pass = array(); //remember to declare $pass as an array
$alphaLength = strlen($alphabet) - 1;
for ($i = 0; $i < 8; $i++) {
$n = rand(0, $alphaLength);
$pass[] = $alphabet[$n];
}
$pwd= implode($pass);
$update_password=new bb_users();
$update_password=$update_password->edit(array(
"do_not_redirect"=>"true",
"this_class"=>"bb_users",
"fields"=>array("_id"=>$u[_id],"password"=>$pwd,"password_reminder"=>"set_by_password_reset")));
bb_sendmail(array("subject"=>"Your New Password - ".date("YmdHis"),
"from"=>"support@domain.com",
"to"=>$u[email],
"body"=>
"
<html>
<head>
</head>
<body>
<table align=center width=640>
<tr>
<td align=left>
Dear ".$u[first_name].",<br>
<br>
You have requested a password reset.<br>
<br>
Your new password is $pwd
<br><br>
Please be sure to change this to something secure, which you will remember, when you log in next.
<br>
from<br>
Support
</td>
</tr>
</table>
</body>
</html>
"));
}
}else{
//error: token failed
}
}
No comments:
Post a Comment