Reset System Settings

Maybe we should consider providing a "reset system" script that will reset a selection of system_settings that can cause total manager access failure to safe defaults. Like "use_captcha" = 0, reset the admin password, stuff like that. We’ll be getting a lot of users that will totally panic at the thought of manually editing their database, and probably rightly so.

That’s a good idea.

That sounds like a huge security risk for the site to me. Do you not agree?

This needs some significant thought put into it and we can’t just include a script that will reset the passwords or turn-off captcha blindly; if someone forgot the password and they can’t use a forgot password link to email the password, the only other secure option is to go into the DB and change the captcha setting and/or the password; otherwise we have total system vulnerability. Instructions on how to reset the password manually and change the captcha setting manually, though secure database user access should suffice for now.

If they panic at the thought of editing the database, they probably shouldn’t be using a database-driven web-site framework, at least not until we have time to evolve it into some kind of web site builder for the technically challenged, which it isn’t, yet.

Well, what if we did this:

Had a standalone download called emergency reset package.

The user simply uploads to the server just like they were re-installing modx.

The script asks a the user to create a file on the server with a random string (like the gallery 2 installation does)

If the file is verified then ask the user for a new password and reset some key settings.

Then, just before writing the new info, the script would backup the previous settings so that they could be recovered.

Hows that sound?

The huge oversight of course is that there is no password reminder on the manager at all.

Mark what you describe is similar to what SMF does as well. Upload a file, execute it and immediatetly delete it.

Your right, we should prob have a password reminder hint option somewhere...

I will take care of the password reminder on the manager as part of the User merge project.

And the recovery package sounds great!