85

Future me, looks like you forgot your password again and locked yourself out of Craft. You also made your way back to this Stack Exchange question with @chris' perfect answer. Good! And to make your life really easy this time around, I've already generated a password/hash combo for you that works: password: NewPassword hash: $2y$13$ftVWpipDuTRbbqYU1lKNv....


26

Craft uses Yii's CPasswordHelper::hashPassword which is a Blowfish hash algorithm, using PHP's crypt function with a "blowFishHashCost", which is a setting that can be found through craft()->config->get('blowfishHashCost') You could use the SecurityService::hashPassword function to generate a new password, echo it, and update it in the DB manually: ...


17

I've actually done this a couple of times... a very simple "password-only" page. Then there would be a large group of people who share that same password, and can gain access to that protected page. Disclaimer: This example was built using the Business Logic plugin template. There are many ways to manage your password, but it sounds like you'll want ...


14

Yes. Use the RequireLogin tag at the top of a page: {% requireLogin %} This tag will ensure that the user is logged in. If they aren’t, they will be redirected to the Login page, and returned to the original page after successfully logging in. (make sure you are logged out before you test this!)


13

It is! To do so, they will have to be logged in and input their old password. They need the old password to change their email or update a password. Here's an example: {% macro errorList(errors) %} {% if errors %} {% for error in errors %} <div class="error icon-cancel-circled">{{ error }}</div> {% endfor %} {...


11

It is very easy within your templates to define requirements for whether the page itself, or portions of the content are displayed, and/or route the user to another page if they do not meet the page requirements. For example, you can check whether the user is logged in, belongs to a particular group, is the author of the entry, has a specific permission (and ...


10

In Craft 2 Plugins have the power to enforce stricter password requirements using the users.onBeforeSetPassword event. Add this code to your plugin’s primary class: public function init() { craft()->on('users.beforeSetPassword', array($this, 'onBeforeSetPassword')); } public function onBeforeSetPassword(Event $e) { $user = $e->params['user']...


9

The easiest way I have found to password protect page content is as follows: {% if craft.request.getParam('password') == 'password_you_want' %} <h2>This is your content</h2> {% else %} <h2>Not authorized</h2> <form action="{{ craft.request.getUrl() }}" method="POST" accept-charset="utf-8" class="form-inline"> ...


8

For security reasons, this was changed in Craft 2.3... Admins are no longer allowed to change other users’ passwords. But savvy admins can still pull it off... Simply click the gear icon in the right sidebar, and select "Copy password reset URL". Then, instead of sending that URL to the user, just use it yourself.


8

Front-end user features are only available in the Pro edition of Craft. Seems like the easiest thing to do would be to use .htaccess password protection for the site.


7

That's because Craft follows the standard procedure of hashing passwords with what's called a "salt" as a security measure. Think about it this way - if a password were hashed without a salt, every instance of the same password would result in the same hashed value. Example: Suppose there are two users, Foo and Bar. They both choose password123 as their ...


6

Craft 2: By default Craft enforces a 6 character minimum as the only password requirement, but as of Craft 2.3, a plugin can now listen for the users.onBeforeSetPassword event to enforce any password requirements it wants for newly set/changed passwords and set $performAction = false to cancel the action with any validation errors returned on the UserModel. ...


5

You can. You have to build some front end forms: Forgot Password Form (http://buildwithcraft.com/docs/templating/forgot-password-form) Set Password Form (http://buildwithcraft.com/docs/templating/set-password-form) Be aware of the config setting, setPasswordPath. It's also worth noting that a user account with control panel privileges will be redirected ...


5

I just released a plugin to solve this problem. No apache/nginx needed, just a simple plugin to install directly in Craft. https://github.com/dgrigg/knockknock


5

You can "Copy password reset URL" and give it to them via some other means (IM, etc.).


5

Download and install a fresh copy of Craft from http://buildwithcraft.com somewhere (doesn't matter if it's the same computer your existing site is on or not). During installation, remember the password you entered when setting up the user. Open the database and look in the craft_users table. Copy what's in the password column for the user that the installer ...


5

There are several config settings which should help... maxInvalidLogins - The number of invalid login attempts Craft will allow within the specified duration before the account gets locked. invalidLoginWindowDuration - The amount of time to track invalid login attempts for a user, for determining if Craft should lock an account. cooldownDuration - The ...


5

It would be possible to write a plugin that provides an alternative login controller action, based on UsersController::actionLogin(). The difference would be that, if normal login fails, it could try checking the old ExpressionEngine database to see if the user exists there, and if so, it could hash up the password in the same way EE does it, and see if it ...


5

If you don’t have access to another admin account, you could unlock the account directly in the database. Change the lock value to 0 for the account in the craft_users table.


4

Short answer, it can't be done. Possibly with some extensive hacking, but I would highly caution against that. Directly importing passwords isn't really possible, since the original passwords are unknown. Adding a custom password column to the database is a bad idea, since Craft user/password management is pretty deeply embedded within the system. Here's ...


4

Use newPassword instead: $user->newPassword = '123456';


4

This is not actually my answer since it's from Andrew Welch on Twitter here: https://mobile.twitter.com/nystudio107/status/1063135843441954816 If you have access to MySQL, you can change the admin user password to secret using this hash: $2y$13$FfVKvo1W1N5Gsba3c19r8uz.x9R5NRQgRu8jmXvOjVCStg1sKGcoW


3

I'm rusty on MySQL so it took me a while to go through this. I'm leaving this here for future internet travelers. It's based on Brad's solution, so read through that first, then you can use these commands. If you forget what your database user/name is, go into Craft > App > Config > db.php Login to MySQL on the command line: $ mysql -u craftuser -p Choose ...


3

The Legacy Login plugin handles authentication from legacy systems such as ExpressionEngine and BigCommerce. It works by intercepting the login, and if the given credentials fail to authenticate with a native user, it tries authenticating a legacy user using the legacy system's particular hashing method. You could add another driver by copying the existing ...


3

I know why this happens - we have the same problem. It is related to the escaping of the & in the password reset URL not being escaped: http://yoursite/admin/actions/users/setpassword?code=abcd&id=1234 somehow, this arrives at our (and your I guess) server as: http://yoursite/admin/actions/users/setpassword?code=abcd&amp;id=1234 Then the ...


3

I’ve done this a few times before and this is how I usually get it done. Set Per Entry Password Within Craft create a new Plain Text field for the entry you would like password protected. The password for the entry can be a phrase, random string of numbers and letters, whatever. Create a Login Template In Craft, set up a route to the login template ...


3

Welcome to Craft! For starters, I would definitely recommend checking out the Pixel and Tonic Guest Entries plugin, brought to you by the guys who built the CMS. As the title suggests, it allows users to create entries from a custom form on the website front-end. So, from your example, you can have an 'Events' channel and allows users to create entries (...


3

Something like this should work, but keep in mind there are lot's of ways to accomplish this. Without knowing your requirements, I'll assume you want an index page of assets, that link to an asset detail page. The detail page would show all comments and provide a form to add new comments. On your assets index page (i.e. '/clientarea/lightbox'): {% ...


3

I hate messing with .htaccess files across multiple environments. I also find .htaccess a bit of black magic as I don't understand regex :) So here's my approach. In index.php - right after the opening PHP tag - drop this in: if($_SERVER['SERVER_ADDR'] == '127.0.0.1') { $username = 'username'; $password = 'password'; if (!(isset($_SERVER['...


3

Currently the users/saveUser (and the deprecated users/setPassword) controller action doesn’t support Ajax requests, so there won’t really be an easy way to tell if it worked or not. If you really want to update user passwords over Ajax, your best bet will be to write a plugin with its own custom controller action, which mimics the password-related stuff in ...


Only top voted, non community-wiki answers of a minimum length are eligible