CakePHP :: Forgotten Password

Sometimes people forget. Usually it is when they need to get into their account or behind the nice ACL system you have setup. So, how do you handle the forgotten passwords?

With our sites we have a small form setup for people to fill in their email address, that will then send them an email with a replaced password, fill in the temporary password in the database, they then can use that new password to log in and change it.

The form in the view just asks for the email address of your blank-minded user. Since it is a user account interaction with the site we use the users_controller to run everything, thus this code goes into the views/users/forgot.ctp.

echo $form->create('User', array('action' => 'forgot'));
echo $form->input('email', array('label' => ''));
echo $form->end('Reset Password');

Next, add the forgot method to your in your users_controller. If we find an email in our database then we shall run the createTempPassword in our user model, Auth the resulting password and send a password.

function forgot() {
   if(!empty($this->data)) {
     $this->User->contain();
     $user = $this->User->findByEmail($this->data['User']['email']);

     if($user) {
       $user['User']['tmp_password'] = $this->User->createTempPassword(7);
       $user['User']['password'] = $this->Auth->password($user['User']['tmp_password']);

       if($this->User->save($user, false)) {
         $this->__sendPasswordEmail($user, $user['User']['tmp_password']);
         $this->Session->setFlash('An email has been sent with your new password.');
         $this->redirect($this->referer());
       }
     } else {
       $this->Session->setFlash('No user was found with the submitted email address.');
     }
   }
}

There are two odd calls in here. The first we are calling $this->User->createTempPassword() – which is a method in the models/user.php. It looks something like this:

function createTempPassword($len) {
   $pass = '';
   $lchar = 0;
   $char = 0;
   for($i = 0; $i < $len; $i++) {
     while($char == $lchar) {
       $char = rand(48, 109);
       if($char > 57) $char += 7;
       if($char > 90) $char += 6;
     }

     $pass .= chr($char);
     $lchar = $char;
   }

   return $pass;
}

It returns a random string that we are saving into the users table. After that we are using the Auth component to set that string as a hashed value, that overrides that old password on Save. When we save it into the database, and everything goes smooth we run the Email Component -> which sends the email address an email.

First include the Email Component in the top of your users_controller.

var $components = array('Email');

And then in the same controller add the following code:

function __sendPasswordEmail($user, $password) {
   if ($user === false) {
     debug(__METHOD__." failed to retrieve User data for user.id: {$user['User']['id']}");
     return false;
  }
  $this->set('user', $user['User']);
  $this->set('password', $password);
  $this->Email->to = $user['User']['email'];
  $this->Email->bcc = array('Your-Domain Accounts <accounts@your-domain.com>');
  $this->Email->subject = 'Password Change Request';
  $this->Email->from = 'noreply@your-domain.com';
  $this->Email->template = 'users_'.$this->action;
  $this->Email->sendAs = 'both'; // you probably want to use both
  $this->Cookie->write('Referer', $this->referer(), true, '+2 weeks');
  $this->Session->setFlash('A new password has been sent to your supplied email address.');

  return $this->Email->send();
}

Done. Set the flash to inform the user of a sent out password. And a redirect back where they came from.

If you have another way to handle forgotten passwords in your sites, I would love to hear what you use, plugins or helpers to handle this kind of forgetfulness. Hit me up in the comments below.