Page 1 of 1

[ABD] Username Or Email Password Reset

Posted: Fri Jun 08, 2018 9:16 am
by martti
In response to this request:

Extension Name: Username Or Email Password Reset
Author: martti
Extension Description:
By default in a phpBB board you need to provide both username and email to reset your password. With this extension you only need one of them.

Only users with a unique email address in the database can use the email addres to request a new password. It is recommanded to check beforehand if all email addresses are unique. When you left the configuration option "Allow email address re-use" in the ACP (General > Board configuration > User registration settings) to the default "false" in your board, this will be the case.
Extension Version: 0.1.0
Requirements: PhpBB 3.2+ PHP 7+
Extension Download: https://github.com/marttiphpbb/phpbb-ex ... master.zip The files are to be put in ext/marttiphpbb/usernameoremailpasswordreset
Github repository: https://github.com/marttiphpbb/phpbb-ex ... swordreset
Languages: en
Templates: prosilver
Screenshot:

Image

Related extensions:

Re: [3.2][BETA] Username Or Email Password Reset

Posted: Fri Jun 08, 2018 12:02 pm
by Brf
So.... an anonymous guest can visit your board and request a password change for your admin accounts without having to know the associated email address?

Re: [3.2][BETA] Username Or Email Password Reset

Posted: Fri Jun 08, 2018 1:39 pm
by null2
Yes, but new password wont be activated because admin should confirm that using a link sent thru email.

Re: [3.2][BETA] Username Or Email Password Reset

Posted: Fri Jun 08, 2018 1:40 pm
by Brf
True, but the anonymous user can cause an admin's email box to be flooded with these password change emails.

Re: [3.2][BETA] Username Or Email Password Reset

Posted: Fri Jun 08, 2018 1:50 pm
by Ger
Or anyone elses mailbox for that matter. Say I have some personal grudge against another user, I just start requesting password changes with his username to annoy him.

Re: [3.2][BETA] Username Or Email Password Reset

Posted: Fri Jun 08, 2018 1:54 pm
by Brf
Indeed. That was my point. It is too easy to abuse.

Re: [3.2][BETA] Username Or Email Password Reset

Posted: Fri Jun 08, 2018 2:23 pm
by martti
Brf wrote:
Fri Jun 08, 2018 1:54 pm
Indeed. That was my point. It is too easy to abuse.
Yes, that was my first thought too. But then it depends if it will actually happen. And when it happens, it is easy to disable the extension again. (And possibly switch to Email Only Password Reset)

Re: [3.2][BETA] Username Or Email Password Reset

Posted: Sun Jun 10, 2018 2:17 am
by null2
Very good extension, thanks for sharing it. Installed and working fine.

Re: [3.2][BETA] Username Or Email Password Reset

Posted: Tue Mar 12, 2019 2:44 pm
by Holger
Would it be difficult to implement anti-flooding? X tries in 24 hours or so?

Re: [3.2][BETA] Username Or Email Password Reset

Posted: Thu Apr 25, 2019 4:21 pm
by martti
As from phpBB 3.2.5 only the email address field is still there, this extension no longer works. This extension is going to be discontinued.