automate password reset

[Cheryl Lemire]

Hello everyone. I have a simple login using an email address for the user and the password is then encrypted using md5(). I would like to create a form allowing the user to change their password OR click on a 'forgot my password' link that would then reset the password and email it to the user recommending that they change it to something they will remember.

This is similar to what happens here in the forum if we were to forget our password. It is reset for us to a random password that is then emailed to us telling us to log in and change it right away.

Before I start playing with xbasic and the various random functions, I wanted to see if anybody has already automated a process like this using xbasic (not web components) before I re-invent the wheel.

Thanks.

[Steve Wood]

Re: automate password reset

Here is the aftervalidate code from my lostpassword component. Just prior to this code, you would get the person to provide their username and then do a lookup to the username table, getting their email address on file. Of course if the username is not found, you fire an error saying not found.

The code creates a new password such as ABC344RF, but you can play with that. It also posts the password to the table, but that is not required since it used the MD5() to authenticate.

IF (email_address = "") THEN
	currentform.has_error = .t.
	currentform.error_message = "Your Customer ID was found."
ELSE
	session.email_pass_sent = email_address
	randnum = ceiling(rand() * 200)
	newpass = upper(rand_string(3) + randnum + rand_string(2))
	hashnewpass = md5(newpass)
	
	a_tbl = table.open("<ADB_Path>\customers")
	query.order = "recno()"
	query.filter = "username="+quote(username)
	query.options = ""
	a_tbl.query_create()
	update.fields = 2
	update.field1 = "password_hash"
	update.field2 = "password"
	update.expr1 = s_quote(hashnewpass)
	update.expr2 = s_quote(newpass)
	a_tbl.update()
	dim e_subject as c
	dim e_body as c
	dim e_bcc as c
	
	e_bcc 		= ""
	e_subject 	= "Message from XYZ"
	e_body		= "We received a request to reset your online password. If you did not make this request, please contact..." + crlf(2) + "New password: " + newpass"
	email_send(email_address,e_subject,e_body,"","",e_bcc,.F.,"","",alltrim(email_profile))
END IF

currentform.redirectTarget = "password_sent.a5w"

END IF

[Cheryl Lemire]

Re: automate password reset

You are the best Steve. That looks simple enough and exactly what I need to start with. I will be working on this in the upcoming week, you just saved me a lot of time, thanks a ton :)

[Cheryl Lemire]

Re: automate password reset

Hi Steve,

So much for getting back to this in a week. I am just now working on the login for my client's was and I have a couple questions for you ... if you don't mind further explaining some things to me :)

Here is the aftervalidate code

I am not using any web components .... Where/how to I use the aftervalidate event?

email_send(email_address,e_subject,e_body,"","",e_bcc,.F.,"","",alltrim(email_profile))

Is email_profile the name of your alpha client profile name?

I had my client setup an email account that I can use for this purpose. I thought I would create an email profile in the alpha email client using this account info that he created for me. If I name the profile 'pwd', would alltrim(email_profile) become alltrim(pwd) .... or is email_profile something you declare elsewhere in code?

Also, I added you to my skype, hoping you will accept me :)

Thanks in advance

[Steve Wood]

Re: automate password reset

You can run the same code on a A5W page. I just happen to use it in a dialog event. The only values in the code I provided that are not defined in the code are email_address and email_profile. The former was obtained by looking up the UserName they provided and grabbig the email address on file, if any. Email_profile is the email profile set up in Alpha. I have several, so have to set this for the send function. Somewhere else it assignes my desired profile to email_profile. If you are using the default profile, you can just omit this parameter completely.

[Cheryl Lemire]

Re: automate password reset

Thanks Steve. Am I correct that I would use the following to assign my desired profile?

EMAIL_SET_ACTIVE( Profile_Name as C )

Also, on another issue, I have not yet done my due diligence in searching ....

I am using code for my login that I created over 3 years ago .... has something changed with using include files? I have the following:

<%A5 
a5w_include("incl\addnewuser.a5w")     
%>

Unfortunately, the actual code is showing on the page? The help files still show a5w_include as valid. The page that has the include in it is 'register.a5w' which is in my webroot. I have a directory 'incl' in the webroot which is where my addnewuser.a5w file resides.

Any ideas why my code shows instead of the file itself being included?

Actually, as I look at my page in the browser further .... all of my

<%A5

shows the actual code, not just the includes. I also have the following:

<%A5 if eval_valid("record_added") then
    ? "Your new image " + record_added + " was added.<br><br>"
end if %>

Which is showing the code exact as above instead of running the code. What am I doing wrong? It has been a while, but if memory serves me correctly .... do I need to start my page with something prior to my html/body tags so that it knows it is an a5w page and processes the commands properly?

[Cheryl Lemire]

Re: automate password reset

Ignore my question on the include files and other a5 code not being run. I did NOT have the web app server started :(

Other questions still apply :)

Thanks