Same problem here, I have found the problem (at least when an admin try to recover the password): CB is using the regular "save" function of JUser object:
Code:
$result = $this->_cmsUser->save(); // Joomla 1.5 native
(line 1133 of cb.tables.php)
But this is not allowed for anonymous user (and if user as forgot password, he is obiouvsly not logged):
Code:
// If user is made a Super Admin group and user is NOT a Super Admin
$my =& JFactory::getUser();
if ( $this->get('gid') == 25 && $my->get('gid') != 25 )
{
// disallow creation of Super Admin by non Super Admin users
$this->setError(JText::_( 'WARNSUPERADMINCREATE' ));
return false;
}
// If user is made an Admin group and user is NOT a Super Admin
if ($this->get('gid') == 24 && !($my->get('gid') == 25 || ($this->get('id') == $my->id && $my->get('gid') == 24)))
{
// disallow creation of Admin by non Super Admin users
$this->setError(JText::_( 'WARNSUPERADMINCREATE' ));
return false;
}
(line 505 of libraries/joomla/user/user.php)
In fact the native Joomla 1.5 password reset, at the last step execute a pure SQL query:
Code:
// Build the query
$query = 'UPDATE #__users'
. ' SET password = '.$db->Quote($password)
. ' , activation = ""'
. ' WHERE id = '.(int) $id
. ' AND activation = '.$db->Quote($token)
. ' AND block = 0';
$db->setQuery($query);
So, the CB password reset feature should be rewritten following the native Joomla 1.5 password reset feature (confirmation email + password reset by query)
nant
I am having the same problem...