Password reset link expiry time

Hi Greg,

Thanks for the message.

I am referring to the front-end website website using the website membership plugin.

I'd be very grateful for the example code.

Many thanks,

Greg

Hey Greg,

I'd highly recommend avoiding increasing the password reset time if possible, as you're reducing the security of your password reset process. Also, as you're changing a core function of one of our plugins we can't provide any support that arises from this change in future. First, you'll need to add this function to your user-password-request.php page after the viewer library has loaded:

  function _custom_isValidPasswordResetCode($userNum, $resetCode) {
    $userNum = (int) $userNum;
  
    // load user
    $user = mysql_get(accountsTable(), $userNum);
    if (!$user) { return false; }
  
    // reset codes are valid for 24-48 hours, check both days
    $codeToday     = _generatePasswordResetCode($userNum, 0);
    $codeYesterday = _generatePasswordResetCode($userNum, -1);
    $threeDaysAgo  = _generatePasswordResetCode($userNum, -2);
    $fourDaysAgo   = _generatePasswordResetCode($userNum, -3);
    $validCodes    = array($codeToday, $codeYesterday, $threeDaysAgo, $fourDaysAgo);
    $isValid       = (int) in_array($resetCode, $validCodes);
  
    //
    return $isValid;
  }

Then, update the line that calls the _isValidPasswordResetCode (line 63 on the default user-password-request.php page) to use our updated function:

    $isValidResetCode = _custom_isValidPasswordResetCode($_REQUEST['userNum'], $_REQUEST['resetCode']);

This code should increase the password security reset time from a maximum of 2 days to 4. 

Thanks,

Greg

Hi Greg,

Thank you for your reply and advice.

The main thing was for me to know how long the link lasted because I am using this function for creating accounts on behalf of users but I do not set a password for them so they need to click the password reset link to set their own password. If they don't do this within the time period then when they click the link it says it has expired and the so the user experience is not great. At least I can now add a message saying the link needs to be clicked within 48 hours.

I will follow your advice and not make any changes to this however it is good learning!

Thanks again,

Greg

Thanks Greg, glad I was able to help! You could also add to the message that if the link has expired they can use the normal password reset page to generate another one.