Reset Password Help

Question

In what table is the token to reset a password saved? How is the token generated?

Answer 1

The password reset procedure happens in the following model

components\com_users\models\reset.php

The token is generated by the following code just prior to the email being sent to the user:

// Set the confirmation token.
    $token = JApplicationHelper::getHash(JUserHelper::genRandomPassword());
    $hashedToken = JUserHelper::hashPassword($token);

    $user->activation = $hashedToken;

As you can probably tell from the fuction names, this generates a random password and saves it as a secure hash in the activation field of the users table.

When the user resets their password, various checks are run, but this is the one that tests that the token matches the one the user has just entered.

if (empty($user) || $user->activation !== $token)
        {
            $this->setError(JText::_('COM_USERS_USER_NOT_FOUND'));

            return false;
        }