Moodle

Forgot password and change password are different in that the first works for not-logged-in user, the other for logged-in users. External url for changing of password works as expected.

The problem is that we can not select the correct login before knowing the username or email if not logged in. Also we should not reveal the existence of user with given username or password.

Maybe we could add some hook into forgot password page and allow plugins to add custom instructions.
Workaround is to supply custom instructions into the right login pane.

..correct plugin... sorry

If the user has forgotten their password then the change password functionality is triggered to give them a new one.

However, your suggestion is, I think, that's pretty much what it did before. If you look back in CVS around version 1.37, you can see where I made a fix to some changes that Martin Langhoff had put in. The area that my change is in is exactly the area that seems to have gone missing recently.

Method change_password_url() should be IMO used only when user is logged in. You never know how is the auth plugin going to construct the url, it might contain data from user table, session, $_SERVER array or something else. I am going to update the inline docs to make the clear. I really want to keep changing and resetting of passwords separate.

The recommended way should be to allow resetting of passwords through Moodle interface and updating of the password in external source.

But that functionality has been in core since 1.6 stable, nealy 2 years ago. I can't be the only person that will be surprised that its disappeared.

I do understand what you're saying about change password should be separated from forgot password functionality, but in that case we need this stuff back in with new auth properties for external forgot password url and external forgot password help at the very least.

I am sorry, the multi auth brought several other changes too. There were many hacks throughout the codebase for various auth plugins and all of them were removed (with the exception of mnet which is a special case). Since 1.8 individual plugins are defined only in /auth/xx/ directories - there is no code outside. I had to change the API and add new methods to allow this.

The reset password is a different problem, for security reasons it treturns always the same result so that ppl can not guess username or password - with your proposed patch it tells the attackers which emails/usernames exist - that is not acceptable for default installs.

Originally the change password was working without login which was often confusing ppl and was non-standard. The mixing of change password and reset password is really not a good idea.

Another solution could be emails with custom instructions for each plugin. Student would recieve email with link to change his/her password.

Sorry, I think I've confused you. Reset password is working fine. Its just what happens with forgot password that I'm worried about.

I agree with your proposal that each plugin could offer custom instructions for forgotten password separate to the custom change password stuff. If you feel it is safer to email those instructions rather than display them directly on the screen, then I guess that's fine by me.

The mailing of password resetting instructions is IMO the only secure solution - I am going to prepare a patch for review with 1.9 as target (because it will require a minor API change).

Thanks

Hello Petr,

This feature was working in 1.6 and 1.7 versions. Not working in the actual stable version (1.8). And you only correct for the next version (1.9)? A version most of the people don't use because is under development...

You (the Moodle team) are doing a very fine job! But seems that you are essentially focused in the development of new versions.
Remember me Microsoft strategy: every time we close and open the eyes they put in the market a new version of their products...

If is always like that, Moodle never will have a full corrected or full stable version...

It seems to me that the right strategy should be: Bugs and very useful improvements must be fixed for the current stable version and for the next version; other improvements only for the next version.

I also need this lost feature for 1.8...

Thanks for reporting this issue.

We have detected that this issue has been inactive for over a year has been recorded as affecting versions that are no longer supported.

If you believe that this issue is still relevant to current versions (2.1 and beyond), please comment on the issue. Issues left inactive for a further month will be closed.

Michael d;

lqjjLKA0p6

I'm closing this issue as it has become inactive and does not appear to affect a current supported version. If you are encountering this problem or one similar, please launch a new issue.