Okay, got it. No, I’m not hacking the password, that is dumb... real dumb. Here is what I did thanks to the real smart WebLoginPE:
If you have your registration type set to ’Verify’ then the users password is sent to their email with a link to log in. This auto generated password is ugly and not memorable so I wanted to prompt my new users with a simple password change on their first log in. Here’s how I accomplished my goal.
I changed the link in the verification email to point to a document with a custom login form. To change the link I edited weblogin.class.php around line 694:
$siteURL = $modx->config['site_url'];
and ADDED directly below:
$siteURL .= 'index.php?id=47';//doc id for custom change password page (remove line for default login)
So the user registers, gets email with random password, clicks custom link and is brought to my custom login call:
[!WebLoginPE? &liHomeId=`51` &loHomeId=`33` &loginFormTpl=`wlpe.login.activate`!]
&loginFormTpl=wlpe.login.activate
<h2>[*longtitle*]</h2>
<p>[*introtext*]</p>
[+wlpe.message+]
<div id="wlpeLogin">
<form id="wlpeLoginForm" action="[~[*id*]~]" method="post">
<fieldset id="wlpeLoginFieldset">
<legend id="wlpeLegend"></legend>
<label id="wlpeUsernameLabel" for="wlpeUsername">Username
<input id="wlpeUsername" type="text" name="username" />
</label>
<label id="wlpePasswordLabel" for="wlpePassword">Password
<input id="wlpePassword" type="password" name="password" />
</label>
</fieldset>
<fieldset id="wlpeLoginButtons">
<button type="submit" id="wlpeLoginButton" name="service" value="login">Activate Account</button>
</fieldset>
</form>
</div>
Just a very simplified version of the regular log in but instead of going to the default profile view the user is brought to my custom change password page via the &liHomeId=`51` parameter. This allows me to put another custom snippet call for my quick password change:
[!WebLoginPE? &type=`profile` &loHomeId=`33` &profileTpl=`wlpe.profile.password` !]
Now, instead of pulling up the normal profile edit form, I created a custom profile template, assigned via &profileTpl parameter. The custom template was basically just going to be the change password section of the normal profile page, however, if I did not include the other inputs (for all the other user attributes) then those values would be deleted/overwritten. So I just left all of the default input tags in the custom template and changed their ’type` to `type=hidden`, I then wrapped those sections of the code in a div and set it to display:none so that only the change password section shows up. It works, sweet!
&profileTpl=wlpe.profile.password
<h2>New Password</h2>
[+wlpe.message+]
<div id="wlpeUser">
<form enctype="multipart/form-data" id="wlpeUserProfileForm" action="[~[*id*]~]" method="POST">
<fieldset id="wlpeUserProfileInput">
<div id="wlpeUserInfo">
<h3 id="wlpeProfileWelcome">Hello [+user.fullname+] ([+user.username+])!</h3>
<p id="wlpeProfileInfo" class="info">[+introtext+]</p>
</div>
<fieldset id="wlpeNewPasswordArea">
<legend id="wlpeNewPasswordAreaLegend"></legend>
<p id="wlpeNewPasswordInfo"><strong style="color: SkyBlue">Create your password</strong> <br /><span class="info">(the default password for your account was sent to you in the registration verification email. Leave this form blank to keep that as your password or choose something easier to remember, it's up to you.</span></p>
<label for="wlpeUserProfilePassword">New Password
<input id="wlpeUserProfilePassword" type="password" name="password" value="" />
</label>
<label for="wlpeUserProfilePasswordConfirm">New Password (confirm)
<input id="wlpeUserProfilePasswordConfirm" type="password" name="password.confirm" value="" />
</label>
</fieldset>
<div style="display:none;"><!-- section needed so values do NOT get erased from database on save -->
<input id="wlpeUserProfileFullName" type="hidden" name="fullname" value="[+user.fullname+]" />
<input id="wlpeUserProfileEmail" type="hidden" name="email" value="[+user.email+]" />
<input id="wlpeUserProfilePhone" type="hidden" name="phone" value="[+user.phone+]" />
<input id="wlpeUserProfileMobile" type="hidden" name="mobilephone" value="[+user.mobilephone+]" />
<input id="wlpeUserProfileFax" type="hidden" name="fax" value="[+user.fax+]" />
<input id="wlpeUserProfileMailingAddress" type="hidden" name="mailingaddress" value="[+user.mailingaddress+]" />
<input id="wlpeUserProfileLot" type="hidden" name="lot" value="[+user.lot+]" />
<input id="wlpeUserProfileState" type="hidden" name="state" value="[+user.state+]" />
<input id="wlpeUserProfileZip" type="hidden" name="zip" value="[+user.zip+]" />
[+form.country+]
<input id="wlpeUserProfileDob" type="hidden" name="dob" value="[+user.dob+]" />
[+form.gender+]
<textarea id="wlpeUserProfileComment" name="comment">[+user.comment+]</textarea>
</div>
</fieldset>
<fieldset id="wlpeUserProfileButtons">
<button type="submit" id="wlpeSaveProfileButton" name="service" value="saveprofile">Save</button>
<button type="submit" id="wlpeProfileDoneButton" name="service" value="cancel">Done</button>
</fieldset>
</form>
</div>
When the user finished changing their password they are brought to the regular default login/profile section. If the user wants to just keep their hard to remember random password then they just click ’done’ button and no password change. It feels better to me to have the system prompt me to change my auto generated password right away. Any ideas about how this could be done more effectively and if there are any security issues I should be aware of would be appreciated. I apologize for starting this post with such a limited question, I should have titled the post "how to direct new users to change their password at login"
Thanks for teaching me you rock!
or just a hint is fine, until then I’ll fumble around with it.
☆ A M B ☆
☆ A M B ☆