Password reset link expiry time

Hey Greg,

The password reset link should remain active for up to 48 hours. Is this for resetting passwords on the front end of the site or in the CMS itself? Updating the reset password code in the CMS would require modifying the core codebase, so it's not recommended. But I can provide you with some sample code for updating the length of the password resets via the Website Membership plugin on the front end of the site if needed.

Cheers,

Greg

Hi Greg,

Thanks for the message.

I am referring to the front-end website website using the website membership plugin.

I'd be very grateful for the example code.

Many thanks,

Greg

Hey Greg,

I'd highly recommend avoiding increasing the password reset time if possible, as you're reducing the security of your password reset process. Also, as you're changing a core function of one of our plugins we can't provide any support that arises from this change in future. First, you'll need to add this function to your user-password-request.php page after the viewer library has loaded:

  function _custom_isValidPasswordResetCode($userNum, $resetCode) {
    $userNum = (int) $userNum;
  
    // load user
    $user = mysql_get(accountsTable(), $userNum);
    if (!$user) { return false; }
  
    // reset codes are valid for 24-48 hours, check both days
    $codeToday     = _generatePasswordResetCode($userNum, 0);
    $codeYesterday = _generatePasswordResetCode($userNum, -1);
    $threeDaysAgo  = _generatePasswordResetCode($userNum, -2);
    $fourDaysAgo   = _generatePasswordResetCode($userNum, -3);
    $validCodes    = array($codeToday, $codeYesterday, $threeDaysAgo, $fourDaysAgo);
    $isValid       = (int) in_array($resetCode, $validCodes);
  
    //
    return $isValid;
  }

Then, update the line that calls the _isValidPasswordResetCode (line 63 on the default user-password-request.php page) to use our updated function:

    $isValidResetCode = _custom_isValidPasswordResetCode($_REQUEST['userNum'], $_REQUEST['resetCode']);

This code should increase the password security reset time from a maximum of 2 days to 4. 

Thanks,

Greg

Thanks Greg, glad I was able to help! You could also add to the message that if the link has expired they can use the normal password reset page to generate another one.