10
As far as I know ExpressionEngine will use one or the other, SHA1 or MD5 (I believe SHA1 is the default). In my test it actually worked to use either one when replacing the password, allowing me to login just fine in both cases.
You can use MySQL to generate a new password hash for yourself. For example either SELECT SHA1('pass123') or SELECT MD5('pass123') ...
6
Use the forgot password form instead?
Exactly. Without building custom code to do this (which is quite doable), this is the way to go - and I suggest using FreeMember and its Forgot Password form on the front-end, so users can use it directly. That way your Client Admins don't have to be bothered.
4
The language is somewhat unclear on that screen. What you actually need to enter is your current password, not the user's current password.
3
There are at least two add-ons which will allow the password reset to work as you described, with the user entering their own password:
FreeMember
See the reset_password tag
The Reset Password tag allows users to change their password directly,
after they click the link in their email.
OR
Securit:ee
See the forgot_password tag
Instead of resetting ...
2
Could you check if its related to this bug report https://support.ellislab.com/bugs/detail/19414
2
Do you have a php enabled template that's publicly accessible? (Or that can be made publicly accessible?)
If so the following code on the template should log you in as whatever member_id you specify.
$member_id = 1; // Or whatever your member ID is
$this->EE =& get_instance();
$this->EE->session->create_new_session($member_id);
2
You can edit the copy in the Message Pages area of the Control Panel... specifically edit the "Password Reset Notification" template.
Control Panel Location: Design ‣ Message Pages
2
From their Docs:
The contents of {password_block} is displayed only when password is
empty.
So {password_block} password == no{/password_block} should do the trick inside the exp:social_login:add_userdata tag.
2
Try this code by putting withing a EE template and run:
ee()->load->library('auth');
ee()->auth->update_password([MEMBER ID], '[NEW PASSWORD]');
For EE2.4:
$EE =& get_instance();
$EE->load->library('auth');
$EE->auth->update_password([MEMBER ID], '[NEW PASSWORD]');
I hope, it would work for you.
2
Automatic creation of password is exactly that: it automatically creates passwords for your users. These are random passwords, which are immediately encoded during the member import. This means that you cannot retrieve these passwords to send to users. Also, you cannot import your own passwords. From the in-add-on instructions:
For security reasons, the ...
2
I once created something similar for an EE1 site where people submit their email address and get back a pin code--though they get the code on the sign-up thank-you web page, not via email.
I used this open source alphaID function for generating the pin codes.
I've used this specifically to generate 4 digit pin codes, and I'm pretty sure you can use the ...
2
No, that is not configurable. Typically, 24 hours should be sufficiently long, and any longer would start to introduce security issues. The user triggering the action is doing so to reset their password now, not some time in the future (or shouldn't be, anyway).
If an active code were to sit in their inbox for many days, for instance, that increases the ...
2
Have done similar and ended up using channel entries to control the access to the file/page then the excellent module File Vault by masuga to obfuscate the actual files url so users cannot share with others.
On the landing page we verify, say {segment_3} to a valid channel entry (could be entries id or a text field within the entry). If there is a valid ...
2
You will need to keep old Drupal members database and create a custom extension that will be triggered when user tries to log in for the first time (password in EE not set). It will utilize Drupal authenticate functions to check whether the user is permitted to log in and it yes - set password in EE database and log him in.
1
Protected Links from Yuri is a very good and efficient add-on to.hide and secure your links.
https://devot-ee.com/add-ons/protected-links
1
These what you are after? It appears these are planned for conversion to services down the road. But should still work now.
https://docs.expressionengine.com/latest/development/extension_hooks/global/member_model/index.html#member-update-start
https://docs.expressionengine.com/latest/development/extension_hooks/global/member_model/index.html#member-update-...
1
How would you intend on changing the password through database updates? From installation to installation, the actual cryptography used for password hashing can vary depending on what's available on the server. EE2 uses sha512, sha256, sha1, and md5 depending on the server/environment. I'm not sure about EE3. To appropriately handle this situation I would ...
1
There's a boat load of options:
FreeMember: http://devot-ee.com/add-ons/freemember
Stand Alone Member Edit: http://devot-ee.com/add-ons/stand-alone-member-edit
OR find some paid for modules: http://devot-ee.com/search/results?keywords=member&addon_version_support=ee2
1
Although you could utilise native login/zoo visitor (although I'd recommend Freemember). I'm not sure how you'll cope with sending out the password and auto generating it, although you could look at trying to fire off the reset password (so a dummy random password is created initially then the user is requested to set the password which is really resetting ...
1
If you find that you need to get at this at a lower level, you might take a look at the source code in AJW Member Import. (I was just using this as a reference for a similar need...)
In the do_import() function in ajw_import_members_model.php (line 186), you'll see this simple conversion of a plain text password to the proper hash used by EE:
$data["...
1
How were these users added to the system?
As far as I can tell there is no maximum length although the input fields both in the CP and the CP login specify 40 maximum characters. So if they were created the "normal way" in the CP then this shouldn't be an issue (just use the first 40 chars in the pwd to log in).
If they were created programatically then ...
1
The forgot password process was changed in EE 2.6.
With ExpressionEngine 2.6 comes a much-improved experience for
resetting a forgotten password. Users will be sent a single email with
a link to a new password form. This lets the user decide what their
new password will be, rather than having the system send a new,
plain-text password in a second ...
1
Is this on the front end or the backend? The front end system changed the forgot password functionality recently to use a password reset form on the front end that relies on the member templates (yuck). The idea was that instead of sending a random general password a user could reset their password with a form after validating an email link.
1
Use the parameter "return" such as return="page/entry_id". Or get the MO'Variables Add-on and use return="{last_page_visited}".
1
Check out these instructions from the EllisLab forum:
You can just create your own CP theme by copying the file found at /system/expressionengine/views/accounts/login.php to /themes/cp_themes/my_theme/accounts/login.php and editing it to your liking. Now when you choose that theme instead of the default theme, EE will use your file instead. For all the ...
1
You shouldn't need the password salted for login to work. ExpressionEngine's member login code is designed to automatically add a salt and improve the hash up login. It's pretty common for a newly-created member to not have a salt.
Obviously this doesn't answer your question completely, but maybe it'll help you narrow down the causes of your issue.
1
I want to post an update to this question for EE 5 because the current answer is pretty outdated.
In order to set a member's password in the DB, you'll need to know what the hash algorithm is. From /system/ee/legacy/libraries/Auth.php we can see the possible options that EE might use:
private $hash_algos = array(
128 => 'sha512',
64 =&...
1
Why not just use the password reset / forgot password function. It's generally accessible at
http://{domain}/{member_trigger}/forgot_password
Where {domain} is your domain name, and {member_trigger} is whatever term you set to trigger member registration and login. Default is 'member' but I believe you're encourage to set it to something else.
Only top voted, non community-wiki answers of a minimum length are eligible
