phpgroupware-users
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Phpgroupware-users] Lost Password Option (was New participant selec


From: Benoit Hamet
Subject: Re: [Phpgroupware-users] Lost Password Option (was New participant select option)
Date: Mon, 14 Jun 2004 17:55:31 +0200
User-agent: Mozilla Thunderbird 0.5 (X11/20040306)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi all,

I have a custom piece of code for things like this. It's only working if you have a way to retrieve the mail of people, And I'm not sure about security level.
The principle is simple :
Ask for the mail of the asker, check if the mail is "valid" in phpgw sense ie is a valid user with an existing account. Then send an email with a "challenge" which is ask in the next form, and putting this challenge you set your password 2 times.

This is not very secure because all this stuff depends of the strength of the mail password/account. There is a lot's of work to do in it because I only do it for my own system (not enough time to finish it) and it's working for LDAP with acccount_lid as emails.

It's poor coded too (and bad looking, use no templates at all), but it still use the phpgwapi. (But don't use any template). I could sent it to you, so you can adapt it to your own needs, before I build a real patch for this.

regards,

Caeies.

Notice : I will be out of the Web for 2 weeks or more. I will perhaps lost this mail address tomorrow, so better to reply to benoit.hamet
(AT) laposte (to) net (hope this is clear :)

Chris Weiss wrote:
a more portable way would be to add 2 more fields for a password reset phrase
question and answer.  There are certainly security issues with this, popular
things like "mothers maiden name" and "pets name" bother me.  When I'm forced
to choose a question I answer it with something that doens't really make sence
to anyone but me.

Dave Hall (address@hidden) wrote:

On Mon, 2004-06-14 at 20:03, Don Graver (dgraver) wrote:

I'll see what I can do.  Unfortunately a patch is tough to create since
my Calendar has all sorts of minor tweaks.  I will have to download the
latest CVS and try to upgrade it with the participant selection.  I'll
get back to you on this.

P.s. any one have a "forgot password" patch?

Now with the new contacts backend it should be possible to do.  One big
problem would be if the user could only access their mail via phpgw :(


-- Don Graver



-----Original Message-----
From: address@hidden
[mailto:address@hidden
On Behalf Of Dave Hall
Sent: Monday, June 14, 2004 11:49 AM
To: phpgw-users
Subject: Re: [Phpgroupware-users] New participant select option

Hi Don,

I am working on getting a prioritised list of features for the
HEAD version of calendar.  I am happy to look at including
something like this.  A nicely formatted patch always helps
motivate me ;)

Cheers

Dave


On Mon, 2004-06-14 at 19:39, Don Graver (dgraver) wrote:

I asked this question a few weeks ago about how to better select
participants than from a straight select box, and I think I

have come

up with a good solution.  I use the javascript code from
http://www.mattkruse.com/javascript/selectbox/.  Once select box
contains all the users, and the other contains all those that are
being invited.  Below is some sample things of what I had to

do to get

it to work...nothing major.



From class.uicalendar.inc.php:
<snip>

switch($GLOBALS['phpgw_info']['user']['preferences']['common']['accoun

t_
selection']) {

...<snip>...

default:
foreach($users as $id => $user_array)
{
if($id != intval($event['owner']))
{
//Added by DG
//Used for better participant selection, separates included from
excluded participants

if ($event['participants'][$id]){
$include_participants .= '    <option value="' .
$id.$event['participants'][$id] . '"
SELECTED>('.$user_array['type'].')
'.$user_array['name'].'</option>'."n";
}else{
$exclude_participants .= '    <option value="' .
$id.$event['participants'][$id] . '">('.$user_array['type'].')
'.$user_array['name'].'</option>'."n";
}
//End edit by DG

$str .= '    <option value="' . $id.$event['participants'][$id] .
'"'.($event['participants'][$id]?'
selected':'').'>('.$user_array['type'].')
'.$user_array['name'].'</option>'."n";

//Added by DG
//Used for better participant selection
$str2 .= '    <option value="' . $id.$event['participants'][$id] .
'"'.($event['participants'][$id]?'
selected':'').'>('.$user_array['type'].')
'.$user_array['name'].'</option>'."n";
//End edit by DG
}
}
$var['participants'] = array
(
'field' => lang('Participants'),
'data'  => "n".'   <select name="participants[]" multiple
size="7">'."n".$str.'   </select>'
);

//Added by DG
//Used for better participant selection, overrides variable set above

$var['participants']['data']='<SCRIPT LANGUAGE="JavaScript"
src="/channels-de/calendar/inc/selectbox2.js"></script>'."nn";
$var['participants']['data'].=<<<EOF
(In some browsers, you can double-click the options.) <p> <TABLE
BORDER=0> <TR> <TD> <b>Exclude</b><br> <SELECT
NAME="excluded_participants" MULTIPLE SIZE=10 >

$exclude_participants

</select> </td> <TD VALIGN=MIDDLE ALIGN=CENTER> <INPUT TYPE="button"
NAME="right" VALUE=">>"


ONCLICK="moveSelectedOptions(this.form['excluded_participants'],this.f

or


m.elements[findIncludeParticipantsIndex()],true,this.form['move
pattern1'

].value)"><BR><BR>
<INPUT TYPE="button" NAME="right" VALUE="All >>"


ONCLICK="moveAllOptions(this.form['excluded_participants'],this.form.e

le


ments[findIncludeParticipantsIndex()],true,this.form['movepattern1'].v

al
ue)"><BR><BR>
<INPUT TYPE="button" NAME="left" VALUE="<<"


ONCLICK="moveSelectedOptions(this.form.elements[findIncludeParticipant

sI


ndex()],this.form['excluded_participants'],true,this['form'].movepatte

rn
1.value)"><BR><BR>
<INPUT TYPE="button" NAME="left" VALUE="All <<"


ONCLICK="moveAllOptions(this.form.elements[findIncludeParticipantsInde

x(


)],this.form['excluded_participants'],true,this.form['movepattern1'].v

al
ue)">
</td>
<TD>
<b>Include</b><br>

<SELECT NAME="participants[]"  SIZE=10 multiple >
$include_participants </select> </td> </tr> <TR> <TD COLSPAN="3"> Do
not allow moving of options matching pattern:<BR><INPUT TYPE="text"
NAME="movepattern1" VALUE="">
<!--<input type="button" name="test"

onclick="selectAllParticipants()"

value="test">-->
</td>
</tr>
</table>
EOF;
//End edit by DG
break;

<snip>...


I also had to add the following javascript functions to the
selectbox.js file to get it to work, as well as add an

onsubmit to the

form in class.uicalender.inc.php to call selectAllParticipants() so
that the participants would be highlighted within the

selectbox prior

to submission.  Here are the added js functions:

From selectbox2.js...

//Added by DG
function findIncludeParticipantsIndex(){ var toIndex='not

found'; for

(var i=0; i < document.forms.length; i++) {
 for (var k=0; k< document.forms[i].elements.length; k++) {
   if (document.forms[i].elements[k].name ==

'excluded_participants'){

     toIndex= k + 5;
     break;
 }
}
return toIndex;
}

function selectAllParticipants(){



selectAllOptions(document.forms[3].elements[findIncludeParticipantsInd

ex
()]);
}



Hope this helps some people...as my users are quite happy with the
selection process now.

Don





_______________________________________________
Phpgroupware-users mailing list
address@hidden
http://lists.gnu.org/mailman/listinfo/phpgroupware-users





_______________________________________________
Phpgroupware-users mailing list
address@hidden
http://lists.gnu.org/mailman/listinfo/phpgroupware-users

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFAzcpzd/RrA5d/NgMRAmidAJwKDzKhznMSvlP0pYqTotqxAyBvYgCeOgS9
MeCuZjD9sV/opsZb9PkPVlU=
=qFGX
-----END PGP SIGNATURE-----




reply via email to

[Prev in Thread] Current Thread [Next in Thread]