7
votes
Craft password encryption
That's because Craft follows the standard procedure of hashing passwords with what's called a "salt" as a security measure.
Think about it this way - if a password were hashed without a salt, every ...
- 146
7
votes
Reset password with MySQL
If you don't want to mess about trying to insert code in the Craft/Yii stack, v3 just calls password_hash():
password_hash($your_password_string, PASSWORD_DEFAULT, ['cost' => 13]);
As a possibly ...
- 171
7
votes
Locked out of my Account, how to get back in?
This is not actually my answer since it's from Andrew Welch on Twitter here: https://mobile.twitter.com/nystudio107/status/1063135843441954816
If you have access to MySQL, you can change the admin ...
- 942
5
votes
How do you password protect a site in progress?
I just released a plugin to solve this problem. No apache/nginx needed, just a simple plugin to install directly in Craft.
https://github.com/dgrigg/knockknock
- 451
5
votes
Recovering (or creating a new) admin account
I'm rusty on MySQL so it took me a while to go through this. I'm leaving this here for future internet travelers. It's based on Brad's solution, so read through that first, then you can use these ...
- 283
5
votes
How do I UNLOCK my account?
If you don’t have access to another admin account, you could unlock the account directly in the database.
Change the lock value to 0 for the account in the craft_users table.
- 36.3k
4
votes
Accepted
Frontend form to change Craft Commerce user's password?
The code you are currently using is for the Set Password form that is used when a user forgets their password and you send them a Password reset email as documented at https://docs.craftcms.com/v3/dev/...
- 1,226
3
votes
Accepted
How to keep the setPasswordPath config when reset password link is expired?
Pretty sure the invalidUserTokenPath config setting is what you're looking for.
- 67.6k
3
votes
Accepted
setPasswordPath being ignored
Picking this up with another project, it looks like the problem was me not specifying a template path as the 'setPasswordPath' config setting. Instead, I was passing a route. I was doing this because ...
- 2,918
3
votes
Accepted
Reset the password of an admin account
If you can access the users table, change the admin email to yours, then just use the forgot password link
- 451
3
votes
Accepted
How to get the original entered password value on registration form error?
You could always use the Craft request object to repopulate the fields, however I don't think it's common practice to repopulate password fields for security reasons.
Another thing that is considered ...
- 3,017
3
votes
Protect a page with a single password?
I’ve done this a few times before and this is how I usually get it done.
Set Per Entry Password
Within Craft create a new Plain Text field for the entry you would like password protected. The ...
- 63
3
votes
Is there a way to block access to assets by url?
You could create what I call a "traffic controller" template.
Route asset requests via the routes config to a template that checks whatever conditions you want, and then either returns a 503 ...
- 1,114
2
votes
Reset password with MySQL
If you have access to craft via the console and you don't need to update via MySQL specifically, try this solution: https://craftcms.stackexchange.com/a/39728/234
php craft users/set-password my-...
- 1,209
2
votes
Password protect whole staging site. Redirect to original page not working
{% requireLogin %} is intended for use with your own login form on the frontend rather than the standard /admin one. From the docs for loginPath:
The URI Craft should use for user login on the ...
- 2,918
2
votes
Accepted
Password validation for resetting password
I wasn't validating againts the field newPassword, only validating against password. Hence why I wasn't getting any feedback. Duplicating the validation for newPassword seems to have resolved this.
- 1,894
2
votes
Accepted
Getting "Invalid verification code." on password reset
In case anyone makes the same silly mistake I did, I had a conditional on the sign-in page that redirected folks to the page they were on before signing in.
After a password reset, it was trying to ...
- 135
2
votes
Accepted
Set Password form - use front-end template for admin users
Not without hacking up some core files, unfortunately.
You can see the logic Craft 2 uses to determine which set password template to render for a given request here: https://github.com/craftcms/cms/...
- 67.6k
2
votes
Enforce password change every 90 days (3 months)
$date90DaysAgo = (new \DateTime())->modify('90 days ago')->format('Y-m-d H:i:s');
foreach(\craft\elements\User::find()->lastPasswordChangeDate('<='.$date90DaysAgo)->all() as $user){
...
- 19.8k
2
votes
Reset admin account password using command line interface
There's not a native Craft console command that could do that, but plugins can supply there own console commands, so you can write a plugin that added a command to do so.
Craft 2 plugin docs: https://...
- 67.6k
2
votes
Accepted
Craft 3 validate new password in change password
I believe what you're looking for is this:
if ($newPassword != $confirmPassword){
Craft::$app->session->setError('Confirm password does not match new password');
$event->isValid = ...
- 67.6k
2
votes
Accepted
Craft 3 setPasswordPath config not working for front end users
If you really want to change the password action url (not the password path) you can only do that in your Twig template and use the |replace('actions/users/set-password', 'account/set-password') ...
- 19.8k
2
votes
Auto login user after password reset via a plugin in Craft3
Those docs were a bit confusing/misleading, so sorry about that. (I don’t even know what it meant by that!)
They’ve been updated for clarity:
After the user successfully logs in, they will be ...
- 34.4k
2
votes
Accepted
Prevent EVENT_BEFORE_VALIDATE in specific case
First, you should test the sender property pointing to the User element.
Second, there's no such property as isNew in that case.
However, you could test that user is new given that its ID won't be ...
- 301
2
votes
Accepted
Set duration of 'newpassword' link validity via config/general?
The setting you're looking for is verificationCodeDuration which defaults to 24 hours (86400 seconds).
https://docs.craftcms.com/api/v3/craft-config-generalconfig.html#verificationcodeduration
(And ...
- 847
2
votes
Forgot Password - Success Message/Flash Message after setting new password on the login screen
The way I handle this is by simply includeing the same template as the login page and passing a Twig variable along with it.
So more specifically, my setPasswordSuccessPath is set to a unique template ...
- 5,689
2
votes
Accepted
Change password messaging per site?
You can do this by overriding fromName and fromEmail in the mailer component config based on your site handle (or language).
You would do this in your config/app.php like so:
'components' => [
'...
- 7,515
2
votes
Expose certain content if on subdomain
Welcome @bobartlett to StackExchange. Within your templates you could test what the current siteUrl is and only show content based on that. In addition if you are on sub.domain.com then test if the ...
- 2,867
2
votes
How to migrate a selection of users passwords from a Craft 3 to a separate Craft 4?
That approach is not going to work.
Due to how Craft handles passwords internally when saving a new user, the hashed password in your Element API feed actually end up being hashed again (as Craft ...
1
vote
Accepted
Possible to set Forgotten Password path in config?
I think that this is because Craft never needs to get there by itself. It's a page you will always link to in one of your templates. So in theory, you can simply link directly to your Forgotten ...
- 472
Only top scored, non community-wiki answers of a minimum length are eligible