5

The standard Joomla password reset process takes three steps:

  1. Enter email address and request reset token
  2. Complete the 'confirm' page with username and reset token (either by copying the token from the password reset email received into the already open browser tab, or by following the reset link in the email that pre-fills the token field but still requires the user to enter their username).
  3. Set and verify new password

I don't really see the point in requiring the user to enter their username when following the reset link provided to them via email - if they received the link, they have control of the email address associated with the user account. Asking them for their username is superfluous.

Granted, the link presently does not include the email address or username as a query parameter, but assuming it did so, step 2 could be bypassed altogether, making the process simpler. You might argue that requiring the user to also provide their username during the reset process increases overall security, but then if you are using the email address as the username as in my case, this is arbitrary and just annoying for users. The reset process could be done without exposing the username at all (by just including the email address as the additional query parameter), if this were of concern at any rate.

I've reviewed the Joomla code for the com_users module and unfortunately, without modifying Joomla code (which I strictly avoid) I can't see a way to manipulate the password reset link included in the reset email, via a plugin or otherwise, before it gets sent out. Can anybody think of a practical way to achieve this?

2 Answers 2

1

Just came across this extension, which would allow me to create an override of the com_users registration controller class (in order to add the extra query parameter to the reset link), as an alternative to the other proposed solution:

https://gruz.ml/en/extensions/mvcoverride.html

Experienced developers only, mind. Might be useful to somebody coming this way.

0

If you only need to modify the com_users module, surely you can just make an override by copy-pasting it into your template, e.g. into: template/html/com_users/registration/default.php?

Then you would like to set username field hidden and set the value to it, which you can load from the database by the query with the reset link unique part.

(Alternatively this for Joomla 1 might contain some clues, if you're a developer: https://forum.joomla.org/viewtopic.php?t=50531)

4
  • Thanks for the reply Nathan. The code of interest is in a model class though (components/com_users/models/reset.php), so I don't know of a way to override that within template files. To my knowledge, it is only view layouts that you can override via templates. Happy to be told otherwise though!
    – John Rix
    Jan 23, 2018 at 11:08
  • I've added an edit to the question. But mostly that's the answer. You just use override and set the value of username by yourself instead of changing model.
    – Alexandr
    Jan 24, 2018 at 8:51
  • @Alexandr... not following you (and don't see any edits to the question by yourself). The existing 'reset' link provided in the email includes only a token. Are you suggesting I query the user table for a row containing this token and use the corresponding username when the user follows the link to the reset confirm page? Makes me a little uneasy from a security standpoint.
    – John Rix
    Jan 24, 2018 at 9:40
  • @JohnRix , edit was not applied in time. From security standpoint - as you mentioned you already have a link - means you have access to mail-box - means you can request to send your login to this and get all the info. So this is no security break, no?
    – Alexandr
    Jan 25, 2018 at 19:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.