Codeigniter - Forgot Password - codeigniter

Question

Hello: I need to implement a forgot password to a login page. Here I explained what I have so far.
Recover view is prompt to received email input
Function email_exists() will verify email. If so, send_email() with $temp_pass key and link.The database will store $temp_pass for further action and verification.
User clicks on the link previously sent passing $temp_pass to function reset_password.
The model controller will verify $temp_pass with database. If so, load view to input new password - and here is where I am stuck because the form points to a controller that does not recognizes $temp_pass therefore unable to reset password.
How can I retrieved the new password, associated with the right user and reset password?
Code below:
Controller
public function recover(){
//Loads the view for the recover password process.
$this->load->view('recover');
}
public function recover_password(){
$this->load->library('form_validation');
$this->form_validation->set_rules('email', 'Email', 'required|trim|xss_clean|callback_validate_credentials');
//check if email is in the database
$this->load->model('model_users');
if($this->model_users->email_exists()){
//$them_pass is the varible to be sent to the user's email
$temp_pass = md5(uniqid());
//send email with #temp_pass as a link
$this->load->library('email', array('mailtype'=>'html'));
$this->email->from('user#yahoo.com', "Site");
$this->email->to($this->input->post('email'));
$this->email->subject("Reset your Password");
$message = "<p>This email has been sent as a request to reset our password</p>";
$message .= "<p><a href='".base_url()."main/reset_password/$temp_pass'>Click here </a>if you want to reset your password,
if not, then ignore</p>";
$this->email->message($message);
if($this->email->send()){
$this->load->model('model_users');
if($this->model_users->temp_reset_password($temp_pass)){
echo "check your email for instructions, thank you";
}
}
else{
echo "email was not sent, please contact your administrator";
}
}else{
echo "your email is not in our database";
}
}
public function reset_password($temp_pass){
$this->load->model('model_users');
if($this->model_users->is_temp_pass_valid($temp_pass)){
$this->load->view('reset_password');
}else{
echo "the key is not valid";
}
}
public function update_password(){
$this->load->library('form_validation');
$this->form_validation->set_rules('password', 'Password', 'required|trim');
$this->form_validation->set_rules('cpassword', 'Confirm Password', 'required|trim|matches[password]');
if($this->form_validation->run()){
echo "passwords match";
}else{
echo "passwords do not match";
}
}
Model_users
public function email_exists(){
$email = $this->input->post('email');
$query = $this->db->query("SELECT email, password FROM users WHERE email='$email'");
if($row = $query->row()){
return TRUE;
}else{
return FALSE;
}
}
public function temp_reset_password($temp_pass){
$data =array(
'email' =>$this->input->post('email'),
'reset_pass'=>$temp_pass);
$email = $data['email'];
if($data){
$this->db->where('email', $email);
$this->db->update('users', $data);
return TRUE;
}else{
return FALSE;
}
}
public function is_temp_pass_valid($temp_pass){
$this->db->where('reset_pass', $temp_pass);
$query = $this->db->get('users');
if($query->num_rows() == 1){
return TRUE;
}
else return FALSE;
}

Answer 1

I am not so sure where you are stuck at. I can get the fact that you are creating a temporary flag for a user which you verify when the user clicks the link. So, that means, you can start with a session at that point, and the user can only reset the password, only if that particular session is active.
After this step, you ask the user to input his new password, and since you have the temporary flag which you call as $temp_pass for the user (please take care that it should be unique), then you can get the user who is trying to reset the password.
So, all you need to do is to run a db query of this kind -
$this->db->where('reset_pass', $temp_pass);
$this->db->update('users', $data); // where $data will have the fields with values you are updating
I guess you made an error
Also, I just noticed in your recover_password() function -
$message .= "<p><a href='".base_url()."main/reset_password/$temp_pass'>Click here </a>if you want to reset your password, if not, then ignore</p>";
Shouldn't the above line be -
$message .= "<p><a href='".base_url()."main/reset_password/".$temp_pass."'>Click here </a>if you want to reset your password, if not, then ignore</p>";
Update
You can pass $temp_pass into the sessions and retrieve from there. That's one way to go about it.

Answer 2

I would like to suggest some improvements to your password-reset procedure.
If you store the reset information separate from the user-model in an own database table, you could store other informations like an expiry date, the user id, and an already-used-flag together with the token. The user model would stay clean, several resets would not interfere with each other.
The reset tokens should not be stored directly in the database, instead you should store only a hash of the tokens. An attacker with read access to the database (SQL-injection) could otherwise reset any account he wishes.
The token should be unpredictable, md5(uniqid()) can be narrowed down badly if you know the time the reset was done.
I published some example code, how such a password-reset procedure could look like, together with a class which can generate safe tokens.