Skip to main content
7 votes

Craft password encryption

That's because Craft follows the standard procedure of hashing passwords with what's called a "salt" as a security measure. Think about it this way - if a password were hashed without a salt, every ...
Sam LeBlanc's user avatar
7 votes

Reset password with MySQL

If you don't want to mess about trying to insert code in the Craft/Yii stack, v3 just calls password_hash(): password_hash($your_password_string, PASSWORD_DEFAULT, ['cost' => 13]); As a possibly ...
tjbp's user avatar
  • 171
7 votes

Locked out of my Account, how to get back in?

This is not actually my answer since it's from Andrew Welch on Twitter here: https://mobile.twitter.com/nystudio107/status/1063135843441954816 If you have access to MySQL, you can change the admin ...
John Morton's user avatar
5 votes

Recovering (or creating a new) admin account

I'm rusty on MySQL so it took me a while to go through this. I'm leaving this here for future internet travelers. It's based on Brad's solution, so read through that first, then you can use these ...
hisnameisjimmy's user avatar
5 votes

How do I UNLOCK my account?

If you don’t have access to another admin account, you could unlock the account directly in the database. Change the lock value to 0 for the account in the craft_users table.
carlcs's user avatar
  • 36.3k
5 votes

How do you password protect a site in progress?

I just released a plugin to solve this problem. No apache/nginx needed, just a simple plugin to install directly in Craft. https://github.com/dgrigg/knockknock
Derrick Grigg's user avatar
5 votes
Accepted

Importing members from EE without password reset

It would be possible to write a plugin that provides an alternative login controller action, based on UsersController::actionLogin(). The difference would be that, if normal login fails, it could try ...
Brandon Kelly's user avatar
4 votes
Accepted

Frontend form to change Craft Commerce user's password?

The code you are currently using is for the Set Password form that is used when a user forgets their password and you send them a Password reset email as documented at https://docs.craftcms.com/v3/dev/...
Andrea DeMers's user avatar
3 votes
Accepted

setPasswordPath being ignored

Picking this up with another project, it looks like the problem was me not specifying a template path as the 'setPasswordPath' config setting. Instead, I was passing a route. I was doing this because ...
Clive Portman's user avatar
3 votes
Accepted

Reset the password of an admin account

If you can access the users table, change the admin email to yours, then just use the forgot password link
Jim Wyse's user avatar
  • 451
3 votes
Accepted

How to get the original entered password value on registration form error?

You could always use the Craft request object to repopulate the fields, however I don't think it's common practice to repopulate password fields for security reasons. Another thing that is considered ...
Andris Sevcenko's user avatar
3 votes
Accepted

What is the least intrusive way to allow a user to change their email address on the front-end?

On the front-end of the site, if you're going through Craft's UsersController->actionSaveUser(), then you're correct... we do require the current user's existing password to create an elevated session ...
Brad Bell's user avatar
  • 67.5k
3 votes
Accepted

How to keep the setPasswordPath config when reset password link is expired?

Pretty sure the invalidUserTokenPath config setting is what you're looking for.
Brad Bell's user avatar
  • 67.5k
3 votes

Protect a page with a single password?

I’ve done this a few times before and this is how I usually get it done. Set Per Entry Password Within Craft create a new Plain Text field for the entry you would like password protected. The ...
noahread's user avatar
3 votes

How can I import existing users with passwords stored in a different format than Craft's hash format?

The Legacy Login plugin handles authentication from legacy systems such as ExpressionEngine and BigCommerce. It works by intercepting the login, and if the given credentials fail to authenticate with ...
Michael Rog's user avatar
  • 3,420
3 votes

Is there a way to block access to assets by url?

You could create what I call a "traffic controller" template. Route asset requests via the routes config to a template that checks whatever conditions you want, and then either returns a 503 ...
cherrykoda's user avatar
  • 1,114
2 votes

Password protect whole staging site. Redirect to original page not working

{% requireLogin %} is intended for use with your own login form on the frontend rather than the standard /admin one. From the docs for loginPath: The URI Craft should use for user login on the ...
Clive Portman's user avatar
2 votes
Accepted

Update user password

You can't use the users.onBeforeSaveUser event to set a user's password as this event happens after the supplied password has been hashed by a private method in the UsersService. Instead, you could ...
Steve Rowling's user avatar
2 votes
Accepted

Password validation for resetting password

I wasn't validating againts the field newPassword, only validating against password. Hence why I wasn't getting any feedback. Duplicating the validation for newPassword seems to have resolved this.
Terry Upton's user avatar
  • 1,894
2 votes

Importing members from EE without password reset

Check out the Legacy Login plugin... https://github.com/TopShelfCraft/Legacy-Login It's designed to handle a migration of users between EE and Craft.
Lindsey D's user avatar
  • 24k
2 votes
Accepted

Getting "Invalid verification code." on password reset

In case anyone makes the same silly mistake I did, I had a conditional on the sign-in page that redirected folks to the page they were on before signing in. After a password reset, it was trying to ...
Travis Gertz's user avatar
2 votes

Enforce password change every 90 days (3 months)

$date90DaysAgo = (new \DateTime())->modify('90 days ago')->format('Y-m-d H:i:s'); foreach(\craft\elements\User::find()->lastPasswordChangeDate('<='.$date90DaysAgo)->all() as $user){ ...
Robin Schambach's user avatar
2 votes
Accepted

Set Password form - use front-end template for admin users

Not without hacking up some core files, unfortunately. You can see the logic Craft 2 uses to determine which set password template to render for a given request here: https://github.com/craftcms/cms/...
Brad Bell's user avatar
  • 67.5k
2 votes

Reset admin account password using command line interface

There's not a native Craft console command that could do that, but plugins can supply there own console commands, so you can write a plugin that added a command to do so. Craft 2 plugin docs: https://...
Brad Bell's user avatar
  • 67.5k
2 votes
Accepted

Craft 3 validate new password in change password

I believe what you're looking for is this: if ($newPassword != $confirmPassword){ Craft::$app->session->setError('Confirm password does not match new password'); $event->isValid = ...
Brad Bell's user avatar
  • 67.5k
2 votes
Accepted

Craft 3 setPasswordPath config not working for front end users

If you really want to change the password action url (not the password path) you can only do that in your Twig template and use the |replace('actions/users/set-password', 'account/set-password') ...
Robin Schambach's user avatar
2 votes

Auto login user after password reset via a plugin in Craft3

Those docs were a bit confusing/misleading, so sorry about that. (I don’t even know what it meant by that!) They’ve been updated for clarity: After the user successfully logs in, they will be ...
Brandon Kelly's user avatar
2 votes
Accepted

Prevent EVENT_BEFORE_VALIDATE in specific case

First, you should test the sender property pointing to the User element. Second, there's no such property as isNew in that case. However, you could test that user is new given that its ID won't be ...
Alban Jubert's user avatar
2 votes
Accepted

Set duration of 'newpassword' link validity via config/general?

The setting you're looking for is verificationCodeDuration which defaults to 24 hours (86400 seconds). https://docs.craftcms.com/api/v3/craft-config-generalconfig.html#verificationcodeduration (And ...
James Greig's user avatar
2 votes
Accepted

Change password messaging per site?

You can do this by overriding fromName and fromEmail in the mailer component config based on your site handle (or language). You would do this in your config/app.php like so: 'components' => [ '...
Oli's user avatar
  • 7,495

Only top scored, non community-wiki answers of a minimum length are eligible