Joomla User Password Reset from an External (Standalone) Script

Question

I have the requirement for a user to reset their password from a mobile application that links into a Joomla site. I have had success in logging in (authenticating and returning a sessionid) but don't seem to be having much luck with resetting a password for this external script.

This code successfully triggers the POST using the required form token session id required in Joomla:

<?php
define('_JEXEC', 1);
define( 'DS', DIRECTORY_SEPARATOR );
//define('JPATH_BASE', dirname(__FILE__));
define('JPATH_BASE', '../');

require_once ( JPATH_BASE .DS.'includes'.DS.'defines.php' );
require_once ( JPATH_BASE .DS.'includes'.DS.'framework.php' );

$mainframe =& JFactory::getApplication('site');
$mainframe->initialise();

require '../libraries/import.php';
?>
<div>
<form 
id="user-registration" 
action="http://siteurl/component/users/com_users/?task=reset.request" 
method="post">

<input 
type="text" 
name="jform[email]" 
value="address@mydomain.co.uk" 
size="30">

<button 
type="submit"
>Submit</button>

<input 
type="hidden" 
name="<?php echo JUtility::getToken(); ?>" 
value="1">
</form>
</div>

I am getting a response of (bool)false when trying to process this via cURL however...

<?php 
$token = JUtility::getToken();
$emailadr = 'email@address.co.uk';


$url = 'http://[i]siteurl[/i]/component/users/com_users/?task=reset.request';
$vars = 'jform[email]='.urlencode($emailadr).'&'.urlencode($token).'="1"';

echo $vars;

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0 );
curl_setopt( $ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HEADER, 0 );
curl_setopt($ch, CURLOPT_POST, TRUE);
curl_setopt($ch, CURLOPT_POSTFIELDS, $vars);
$response = curl_exec($ch);

var_dump($response);

This (along with about 20 other combinations of curl parameters, urlencode toggling, swapping of arrays/strings) returns (bool) False.

Any obvious faults with this?

Do Joomla controls require certain httpheader?

Answer 1

Curl expects the vars in simple key=> value form, then http encoded. So you need to set:

$vars = 'jform[email]='.urlencode($emailadr).'&'.urlencode($token).'=1';

Note, no " for the field value of the token field