Password Reset Manager

The standard reset flow depends on an email link, which fails when mail is not configured. This module adds direct reset pages on the login screen where a user gives the user name and either the old password or the master password with the new one. It is built on the signup module and replaces the email step with a controlled form. Administrators keep access control through the server master password.

1. 1

   Open forgot password

   On the login page press the reset link. The route /web/forgot_password renders the Reset password template. It asks for the user name.

   • Link added after the login button
   • Field: user_name
2. 2

   Direct reset with old password

   The direct page asks for old password, new password and confirmation. The controller checks that both new values match and authenticates the old one. On success the password is written and the user is sent to login with a message.

   • Fields: old_password, new_password, confirm_new_password
   • Route /web/reset_password/submit
3. 3

   Reset with the master password

   When the old password is lost the user enters the master password with the new one. The controller verifies it against the server configuration. Only then the user password is changed.

   • Field: master_password
   • Route /web/reset_by_master_pass/submit
4. 4

   Validation and protection

   Public users cannot change passwords and mismatching values return an error message. Errors re-render the form with the message. Restrict the master password to administrators.

   • Public users blocked
   • Mismatch error message

Back to version applications