Cynergise - Social Media Consultancy by Chandesh Parekh » Web Development and Programming

Joomla : Fixing the User Password Reset Feature

Chandesh Parekh — Wed, 21 Sep 2011 09:44:24 +0000

Recently on one of my Joomla projects a user complained that they used the Password Reset feature but they encountered an error in the final steps of the process.

How does Joomla’s Password Reset feature work?

Joomla’s Password Reset feature asks for the user’s email address which it checks for in the user account table against that user’s record.

If found a unique token (a long series of numbers & characters) is generated and this is sent to the email address with a link back to the correct page on the website where the token needs to be entered to complete the process and allow the user to reset their password.

What went wrong?

Unfortunately, the email sent to the user displays the token in this manner :

The token is 408ebfa6c89glda0d267543e07a4cdeb4 .

Notice the space before the period? Well, understandably, the user was copying everything upto the preiod, including the space and pasting it into the field provided on the website for the final step. Unfortunately, that extra space counts as a character and so the token did not match and the user received an error and was unable to complete the reset. Not good.

The fixes

There are two fixes for this issue:

Format the email properly so there is less of a chance of user error;
Run the submitted token through PHP’s trim() function to strip out empty characters on either side of the token.

Making these two fixes should prevent this error occurring again and keep users who need to reset their passwords from becoming frustrated.

How to?

Format the email to remove the space

The first step requires us to amend the email that is sent out to the user. Joomla uses language files so it’s quite easy to amend this message. The reset password function is a part of the User Component in Joomla (com_user) so look up the correct file in the ‘language’ folder/directory :

/WEBROOT/language/en-GB/en-GB.com_user.ini

Search for this text “PASSWORD_RESET_CONFIRMATION_EMAIL_TEXT” and edit the value of this setting by removing the space and period. I added newlines (\n) before and after the token (%s) so that the token displays on a line by itself.

This has two advantages:

Makes it clearer to the user if the token is on a line by itself
Reduces the chance of user error when copying/pasting

Use trim() to remove whitespace

The second fix is the better one as it tackles the actual issue of readying the submitted token for comparison and matching.

In order to do this go to the following file :

/WEBROOT/components/com_user/models/reset.php

Search for the text “function confirmReset($token)” and inside this function add the trim function like so:

function confirmReset($token)
{
global $mainframe;

$token = trim($token);

……….. function continues ………..

}

This will now remove all extra whitespace on either side of the token submitted by the user so that the ‘clean’ token is used for comparison.

And that’s it – you will now have a sturdier Reset Password feature in Joomla.

Installing and running the Zend Framework on XAMPP

Chandesh Parekh — Tue, 27 Oct 2009 16:21:35 +0000

I’ve recently started looking at the ZEND framework for PHP and wanted to know how to install and run it on my Windows XAMMP development environment.

Norman Kosmal has a nice post on how to do this here and the Zend folk have a nice quick-start guide here

Keep your WordPress site secure

Chandesh Parekh — Thu, 17 Sep 2009 15:34:08 +0000

More and more websites are using WordPress as their back-end Content Management System due to its ease of use and excellent built-in search-engine-optimization.

However, as with all software, WordPress does have bugs that are exploited to wreak havoc on your site.

This blog article talks about upgrading your WordPress installation to ensure the latest security patches have been applied and of the latest WordPress vulnerability.

Create mockups using Pencil and Firefox

Chandesh Parekh — Thu, 03 Sep 2009 07:33:39 +0000

A screen mockup in under a minute with Pencil

Prototyping is the method by which a designer/developer mocks up pages/screens for a web site or some piece of software, to help the design and development team visualize the product. Sketching out on a piece of paper is generally best as at this stage of development there are likely to be many changes and sketching on paper is quick and cheap.

However, if you need to create sketches that are a little more professional, e.g. for a presentation to the Board, then it helps to use a tool like Pencil, a plugin for Firefox, which allows you to build a prototype using actual screen elements e.g. buttons, text fields etc. Using it is dead simple and very quick – just drag and drop elements onto a canvas and edit the properties to suit. I made the one on the right in under a minute.

Get Pencil for Firefox here

No related posts.

Use hooks to customize your WordPress site

Chandesh Parekh — Fri, 21 Aug 2009 16:00:17 +0000

WordPress is a powerful publishing platform (this site uses it) and it seems to be going from strength to strength. This is partly due to the fact that WordPress is easy to hack i.e. it’s easy to re-write code to make the platform do what you want it to.

Hacking core files, however, is problematic as the hacks are overwritten whenever you upgrade to a newer version, something that you need to do fairly often due to security holes being found and plugged and new features being introduced.

To overcome this problem, read this Smashing Magazine article on ‘hooks’ and how they can be used to provide you with powerful tools to customize your WordPress site.

Keep your WordPress site secure

RokDownloads – great Joomla Component for File Download Management

Chandesh Parekh — Sat, 13 Sep 2008 17:28:54 +0000

Over the last few weeks I’ve gotten increasingly busy (hence the lull in articles on this site) in customising certain Joomla components at work.

One component I came across just last week is RokDownloads. This is a file-download management component for Joomla 1.5 and as the name suggests it rocks! Developed by the same team that create the brilliant templates for Joomla, RocketWerx (RocketTheme) I guess it’s not that much of a surprise what a quality component this is.

I was using a popular component called DOCman however when it came to customising, it proved pretty difficult mostly due to the fact that it had first been developed for Joomla 1.0x and the team that created it only ported it to work in Joomla 1.5 Legacy Mode; meaning basically that they hadn’t really used the MVC (Model, View, Controller) protocol the way it’s used for Joomla 1.5 Native components.

RokDownloads is proving much easier to customise and even if you don’t need any customisation it just works really well.

So, if you’re looking for a great, free file-download manager hit up RokDownloads.

Joomla 1.0x Developers Manual

Chandesh Parekh — Thu, 24 Jul 2008 06:55:23 +0000

Although Joomla is a very popular open source application for building content-rich web sites, the available documentation for version 1.0x leaves a lot to be desired.

Currently working on a pretty big, and complicated, project involving multiple Joomla sites, I went off in search of relevant material that would help me design and build custom components and modules for version 1.015.

Unfortunately, I couldn’t find any single document that provided me with the information I needed, that is until I happened on a post on the Joomla Forum where someone had helpfully posted a link to a PDF of the Joomla Developers Manual.

Now, this guide for version 1.0x is incomplete, and will remain ever so since the Joomla Documentation Team are concentrating on getting a comprehensive Joomla 1.5 guide ready, however it does offer a lot of important information that you’ll only otherwise get by spending hours on the Joomla Forum and on other sites trying out tutorials.

So, if you’re looking for a ,somewhat, single document in PDF format that can help you understand the Joomla CMS engine a little better and help in building your own components and modules, look no further – click here to download the Joomla Developers Manual.

Cheat Sheets for PHP, Ruby on Rails, MySQL, CSS and SEO

Chandesh Parekh — Tue, 15 Jul 2008 06:47:20 +0000

I went on a bit of a Cheat Sheet binge this month. Working on a couple of projects using various technologies means I keep bouncing around looking for stuff so I thought I’d better get some cheat sheets up on my wall to save me time.

Most of these are from one site, the brilliantly named “ILoveJackDaniels” by UK web developer Dave Child:

Ruby and PHP are the Leading Web Development Languages according to Sun’s Tim Bray

Chandesh Parekh — Tue, 08 Jul 2008 07:55:50 +0000

Tim Bray, director of Web Technologies at Sun Microsystems, said in April’s Ruby Conference that Ruby and PHP are the languages of choice for new web applications.

Both Ruby and PHP are open source and therefore it comes as no surprise that both these languages are being taken up far more quickly than established languages like Java.

There are other factors too; One of the main ones is that many new web applications need to reach their market as quickly as possible. Applications developed in compiled languages like Java cannot be rolled out iteratively as compared to those developed using interpreted scripting languages like Ruby or PHP making them far less desirable.

There are also quite a few web development frameworks built on these two languages around now, Rails based on Ruby and Symfony based on PHP are two that I know of. This makes it even faster, and easier, to develop and deploy a new web application.

Find out more about:

How well does a Ruby on Rails Application scale?

Chandesh Parekh — Tue, 24 Jun 2008 10:42:17 +0000

A lot is usually made of the scalability of Ruby on Rails applications, usually leaning toward the negative.

ZDNet spoke to LinkedIn about their viral application, called BumperSticker, for Facebook which sees in the region of 1 billion page views a month!

Read the article on ZDNet.com here…

BuildingWebApps.com – A great resource for Ruby on Rails Developers

Chandesh Parekh — Tue, 17 Jun 2008 07:48:31 +0000

I know this has nothing, well almost nothing, to do with Internet-related business but I’m so impressed with this site and its founders that I just had to write about it.

For those of you who may not know of it, Rails is a web development framework built using the programming language Ruby. The framework is popularly known as Ruby on Rails.

I’ve finally found some time, after almost a year of trying, to get into learning Rails. As a web developer and programmer it’s important for me to:

Keep up with the latest technology in web development to build my own projects and projects for clients;
And to keep up with the technology so I know what’s possible when I’m thinking of, or developing, a new Internet-based business.

Anyway, in my quest to learn Rails, I found the site www.buildingwebapps.com, created by Mike Slater and Christopher Haupt the founders of Collective Knowledge Works, Inc. a web development agency in the US.

If you’re learning Rails or are interested in learning Rails I highly recommend this site.