Password recovery with email only registration

15 years 9 months ago #69105 by nnwltrs
Not a showstopper but ...
My client wants his site login to be email only (ala the social networking sites). So naturally I'm loving the new email only registration option in CB.

I've noticed a problem however with the password recovery workflow: My site is set up so that users never see a username (I made the username field optional and removed it from the registration form). However, when a user forgets his password, he's required to enter a username in order to recover it.

We're going to work around the problem by explaining that usernames are used as a security measure for password recovery :P but it does make for a less than seamless experience.

Please Log in to join the conversation.

15 years 9 months ago #69287 by beat
You are right.

Also in user editing (frontend) the username is visible (or even changeable if allowed in CB global configuration).

These are a few of all the things that we will keep for CB 1.3 ;)

Beat - Community Builder Team Member

Before posting on forums: Read FAQ thoroughly -- Help us spend more time coding by helping others in this forum, many thanks :)
CB links: Our membership - CBSubs - Templates - Hosting - Forge - Send me a Private Message (PM) only for private/confidential info

Please Log in to join the conversation.

15 years 7 months ago #77125 by curt
I would also like to enable my users to use Email only (no username).

My registration form has:

first name
last name
email
password

However, the problem is that CB writes first name and last name into jos_users.username. This means that 2 users cannot have the same first and last name.

I can sucessfully register John Smith. When I try to register a second John Smith, CB tells me that the username is taken already, which will be confusing to the user.

Please tell me where is the source code for me to customize so that registration does not check for duplicate username and also the source code so that "forgot password" prompts only for e-mail and not password.

Thanks!

Please Log in to join the conversation.

15 years 7 months ago #77156 by nnwltrs
I don't think you should remove the check for duplicate usernames. Other parts of the system are probably keying on that field. A better strategy would be to create a unique username if there is a dup. (This should really be addressed in CB itself but you could hack it for now.)

One algorithm:
Do a databse SELECT on the synthesized username. Count the number of rows returned. Then append the count number to the newly synthesized name. So the first john smith is 'johnsmith0', and so on. Actually, I'd probably not append anything if the count were zero.

Not sure if this can be done in a user plugin (beforeRegistration event?) but that might be the safe approach. If you're in a hurry, look at comprofiler.php in saveRegistration(). I think that would be the right place.

Please Log in to join the conversation.

15 years 7 months ago #77184 by curt
nnwltrs:

Thanks for your reply and suggestion.

Your algorithm seems like it should work for the first 2 JohnSmith's, but will it work for the third and onwards? When the second JohnSmith registers, I can count the number of JohnSmith's and then write JohnSmith2 into the DB. When the third JohnSmith registers, if I count JohnSmith, I will still get 1, not 2.

If I find and hack the code to do what you suggested, I'll still have to find and hack the code for "Forgot Password" so that it does not prompt for Username. Do you know where that code is?

Thanks for your help.

Please Log in to join the conversation.

15 years 7 months ago #77188 by nnwltrs
curt wrote:

Your algorithm seems like it should work for the first 2 JohnSmith's, but will it work for the third and onwards? When the second JohnSmith registers, I can count the number of JohnSmith's and then write JohnSmith2 into the DB. When the third JohnSmith registers, if I count JohnSmith, I will still get 1, not 2.

Ah, I see what you mean. You need to use the LIKE clause in the sql query:
"SELECT COUNT(*) FROM __comprofiler WHERE username LIKE 'BobSmith%'"

If I find and hack the code to do what you suggested, I'll still have to find and hack the code for "Forgot Password" so that it does not prompt for Username. Do you know where that code is?

Sorry, not offhand. What I've done on one site where we have a similar issue is hacked out the forgot password link in the login module to send a message to our tech support where we fix it manually on the backend. This site is in limited deployment though so I'm fudging a bit on some things that wouldn't work for general purpose sites.

Please Log in to join the conversation.

Moderators: beatnantkrileon
Time to create page: 0.274 seconds

Facebook Twitter LinkedIn