Amitkumar Dudhat

dominic_ks

<p>A simple plugin that adds a password reset facility to the WordPress REST API using a code. The process is a two step process:</p>
<ol>
<li>User requests a password reset. A code is emailed to their registered email address</li>
<li>The user enters the code when setting a new password, which is only set if the code is valid and has not expired</li>
</ol>
<p>It is also possible to check the validity of a code without resetting the password which enables the possibility of setting the password by other means, or having a two stage process for checking the code and resetting the password if desired.</p>
<p>Default settings are to use an 8 digit code consisting of numbers, upper and lower case letters and special characters, which has a life span of 15 minutes, afterwhich a new code would need to be requested. By default a user can attempt to use or validate a code up to 3 times before automatically invalidating it.</p>
<h3>Endpoints</h3>
<p>The plugin adds two new endpoints to the REST API:</p>
<ul>
<li>
<p>Endpoint: <em>/wp-json/bdpwr/v1/reset-password</em><br />
— HTTP Verb: POST<br />
— Parameters (<strong>all required</strong>):<br />
— email</p>
</li>
<li>
<p><em>/wp-json/bdpwr/v1/set-password</em><br />
— HTTP Verb: POST<br />
— Parameters (<strong>all required</strong>):<br />
— email<br />
— password<br />
— code</p>
</li>
<li>
<p><em>/wp-json/bdpwr/v1/validate-code</em><br />
— HTTP Verb: POST<br />
— Parameters (<strong>all required</strong>):<br />
— email<br />
— code</p>
</li>
</ul>
<h3>Example Requests (jQuery)</h3>
<h3>Reset Password</h3>
<pre><code>$.ajax({
  url: '/wp-json/bdpwr/v1/reset-password',
  method: 'POST',
  data: {
    email: 'example@example.com',
  },
  success: function( response ) {
    console.log( response );
  },
  error: function( response ) {
    console.log( response );
  },
});
</code></pre>
<h3>Set New Password</h3>
<pre><code>$.ajax({
  url: '/wp-json/bdpwr/v1/set-password',
  method: 'POST',
  data: {
    email: 'example@example.com',
    code: '1234',
    password: 'Pa$$word1',
  },
  success: function( response ) {
    console.log( response );
  },
  error: function( response ) {
    console.log( response );
  },
});
</code></pre>
<h3>Validate Code</h3>
<pre><code>$.ajax({
  url: '/wp-json/bdpwr/v1/validate-code',
  method: 'POST',
  data: {
    email: 'example@example.com',
    code: '1234',
  },
  success: function( response ) {
    console.log( response );
  },
  error: function( response ) {
    console.log( response );
  },
});
</code></pre>
<h3>Example Success Responses (JSON)</h3>
<h3>Reset Password</h3>
<pre><code>{
    "data": {
        "status": 200
    },
    "message": "A password reset email has been sent to your email address."
}
</code></pre>
<h3>Set New Password</h3>
<pre><code>{
    "data": {
        "status": 200
    },
    "message": "Password reset successfully."
}
</code></pre>
<h3>Validate Code</h3>
<pre><code>{
    "data": {
        "status": 200
    },
    "message": "The code supplied is valid."
}
</code></pre>
<h3>Example Error Responses (JSON)</h3>
<h3>Reset Password</h3>
<pre><code>{
    "code": "bad_email",
    "message": "No user found with this email address.",
    "data": {
        "status": 500
    }
}
</code></pre>
<h3>Set New Password</h3>
<pre><code>{
    "code": "bad_request",
    "message": "You must request a password reset code before you try to set a new password.",
    "data": {
        "status": 500
    }
}
</code></pre>
<h3>Validate Code</h3>
<pre><code>{
    "code": "bad_request",
    "message": "The reset code provided is not valid.",
    "data": {
        "status": 500
    }
}
</code></pre>
<h3>Filters</h3>
<p>A number of WordPress filters have been added to help customise the process, please feel free to request additional filters or submit a pull request with any that you required.</p>
<h3>Filter the length of the code</h3>
<pre><code>add_filter( 'bdpwr_code_length' , function( $length ) {
  return 4;
}, 10 , 1 );
</code></pre>
<h3>Filter Expiration Time</h3>
<pre><code>add_filter( 'bdpwr_code_expiration_seconds' , function( $seconds ) {
  return 900;
}, 10 , 1 );
</code></pre>
<h3>Filter the date format used by the plugin to display expiration times</h3>
<pre><code>add_filter( 'bdpwd_date_format' , function( $format ) {
  return 'H:i';
}, 10 , 1 );
</code></pre>
<h3>Filter the reset email subject</h3>
<pre><code>add_filter( 'bdpwr_code_email_subject' , function( $subject ) {
  return 'Password Reset';
}, 10 , 1 );
</code></pre>
<h3>Filter the email content</h3>
<pre><code>add_filter( 'bdpwr_code_email_text' , function( $text , $email , $code , $expiry ) {
  return $text;
}, 10 , 4 );
</code></pre>
<h3>Filter maximum attempts allowed to use a reset code, default is 3, -1 for unlimmited</h3>
<pre><code>add_filter( 'bdpwr_max_attempts' , function( $attempts ) {
  return 3;
}, 10 , 4 );
</code></pre>
<h3>Filter whether to include upper and lowercase letters in the code as well as numbers, default is false</h3>
<pre><code>add_filter( 'bdpwr_include_letters' , function( $include ) {
  return false;
}, 10 , 4 );
</code></pre>
<h3>Filter the characters to be used when generating a code, you can use any string you want, default is 0123456789</h3>
<pre><code>add_filter( 'bdpwr_selection_string' , function( $string ) {
  return '0123456789';
}, 10 , 4 );
</code></pre>
<h3>Filter the WP roles allowed to reset their password with this plugin, default is any, example below shows removing administrators</h3>
<pre><code>add_filter( 'bdpwr_allowed_roles' , function( $roles ) {

  $key = array_search( 'administrator' , $roles );

  if( $key !== false ) {
    unset( $roles[ $key ] );
  }

  return $roles;

}, 10 , 1 );
</code></pre>
<h3>Filter to add custom namespace for REST API</h3>
<pre><code>add_filter( 'bdpwr_route_namespace' , function( $route_namespace ) {
  return 'xyz/v1';
}, 10 , 1 );
</code></pre>
<h3>Credits</h3>
<ul>
<li>Plugin icon / banner image by <a href="https://unsplash.com/photos/CWL6tTDN31w" rel="nofollow ugc">Sincerely Media</a></li>
</ul>


Password Reset with Code for WordPress REST API

This is an awesome plugin. Solved some problems quickly for me

Awesome Plugin

A simple plugin that adds a password reset facility to the WordPress REST API using a code. The process is a two step process:

Fidgety Lizard

Kona Macphee

<p>PLEASE NOTE: AS OF WP 5.7, THIS PLUGIN IS NO LONGER SUPPORTED.</p>
<p>Since WordPress 4.3, new users are no longer sent their passwords directly by email.  Instead, they are sent a message containing a link to the Reset Password page, where they can choose their own password.  Additionally, the Reset Password page now appears with a strong password already suggested in the “New password” field.</p>
<p>This plugin <strong>removes</strong> the suggested password from the Reset Password page, leaving the “New password” field empty.  Below this field it <strong>adds</strong> a “Suggest a password” button whose action is to fetch a new suggested password via Ajax.</p>
<p>Also since 4.3, Firefox and Chrome users may notice problems saving their new password in their browser from the Password Reset page.  (Firefox saves the password with an empty username; Chrome sets the username and password to the password value.) This plugin tweaks the password reset form so that these browsers can successfully save the username and newly-reset password if the user wishes.</p>
<p>Note that Internet Explorer, Edge and Safari will not offer to save the password from the Password Reset page, and this plugin does not change that behaviour.  Therefore, the plugin adds a configurable warning message to the Password Reset screen, advising users to make a note of their new password.</p>
<p>The form tweaking for Firefox/Chrome and the configurable warning message are enabled by default, but they can be disabled in the administration settings.</p>


Clarify Password Reset

When working with sites with lots of members unfortunately you realise most people are complete idiots.. 
Thanks to this plugin these idiots doesn't assume their password has been reset already to a "sooooo hard" string. I've never experienced the saving issues with chrome and FF so I disabled that but the suggest button is a good softer alternative to prefilled password field. 
Keep up the good work!



Does the trick!

As I had a new member who did not understand how to get his password, I thing the plugin is a very good idea and should inspired WP official team.



very good idea

AS OF WP 5.7, THIS PLUGIN IS NO LONGER NEEDED OR SUPPORTED.
Clears initial suggested password on WP 4.3+ password reset page, and adds a Generate Pass …

Password Reset with Code for WordPress REST API vs Clarify Password Reset