Reset forgotten password glitch

Report · Jan 09, 2011

Working through the Powers' latest book. Everything seemed to be working fine in local testing environment recently. When I uploaded the files tonight to the remote server and did a test of the forgotten password feature, I'm getting a message at the top of the Request Received screen (p. 293) that says "Connection refused" and not seeing the reset email come in. The request_reset.php code is below:

<?php
$errors = FALSE;
$result = FALSE;
if ($_POST) {
  require_once('library.php');
  require_once('mail_connector.php');
  try {
     $val = new Zend_Validate_EmailAddress();
     if (!$val->isValid($_POST['email'])) {
       $errors = TRUE;
     }
     if (!$errors) {
       $sql = $dbRead->quoteInto('SELECT user_id, first_name, last_name, email FROM users WHERE email = ?', $_POST['email']);
       $result = $dbRead->fetchRow($sql);
       if (!$result) {
          $errors = TRUE;
       } else {
        // update database and send mail
          $token = md5(uniqid(mt_rand(), TRUE));
          $data = array('token' => $token);
          $where = $dbWrite->quoteInto('email = ?', $_POST['email']);
          $dbWrite->update('users', $data, "user_id = {$result['user_id']}");     
       }
       $mail = new Zend_Mail('UTF-8');
       $mail->addTo($result['email'], "{$result['first_name']} {$result['last_name']}");
       $mail->setSubject('Instructions for resetting your password');
       $mail->setFrom('peter_mcdonald@comcast.net', 'Wild Felid Association');
       $link = "http://www.conmolbry.com/WFRMA/reset.php?id={$result['user_id']}&token=$token";
       $message = "Use the following link to reset your password. This link can be used once only. $link";
       $mail->setBodyText($message, 'UTF-8');
       $mail->send();
     }
  } catch (Exception $e) {
     echo $e->getMessage();
  }
}

Peter

Report · Jan 10, 2011

conmolbry wrote:
The request_reset.php code is below:

Peter

Somehow, I don't thing the code is "Peter". Looks like something is missing from your post.

Report · Jan 10, 2011

Indeed. Even my post had a glitch. Try again:

<?php
$errors = FALSE;
$result = FALSE;
if ($_POST) {
  require_once('library.php');
  require_once('mail_connector.php');
  try {
     $val = new Zend_Validate_EmailAddress();
     if (!$val->isValid($_POST['email'])) {
       $errors = TRUE;
     }
     if (!$errors) {
       $sql = $dbRead->quoteInto('SELECT user_id, first_name, last_name, email FROM users WHERE email = ?', $_POST['email']);
       $result = $dbRead->fetchRow($sql);
       if (!$result) {
          $errors = TRUE;
       } else {
        // update database and send mail
          $token = md5(uniqid(mt_rand(), TRUE));
          $data = array('token' => $token);
          $where = $dbWrite->quoteInto('email = ?', $_POST['email']);
          $dbWrite->update('users', $data, "user_id = {$result['user_id']}");     
       }
       $mail = new Zend_Mail('UTF-8');
       $mail->addTo($result['email'], "{$result['first_name']} {$result['last_name']}");
       $mail->setSubject('Instructions for resetting your password');
       $mail->setFrom('peter_mcdonald@comcast.net', 'Wild Felid Association');
       $link = "http://www.conmolbry.com/WFRMA/reset.php?id={$result['user_id']}&token=$token";
       $message = "Use the following link to reset your password. This link can be used once only. $link";
       $mail->setBodyText($message, 'UTF-8');
       $mail->send();
     }
  } catch (Exception $e) {
     echo $e->getMessage();
  }
}

Report · Jan 11, 2011

The "Connection refused" message is coming from the catch block. It's telling you that the connection was refused by the mail server.

Looking at your script, I see that you're including mail_connector.php. I presume that is still pointing to the SMTP server you were using for local testing. I'm surprised that it's rejecting a connection from your remote server, but it might be something to do with relay policies.

If you re-read page 261, you'll see that by default Zend_Mail hands the message and headers directly to the server's MTA. You don't need to create a transport object unless you need to use SMTP authentication or supply the fifth argument to mail().

I suggest you comment out the line that includes mail_connector.php.

// require_once('mail_connector.php');

If that works, you're in business. If it doesn't, remove the double slash, and change the content of mail_connector.php like this:

<?php
$transport = new Zend_Mail_Transport_Sendmail('-fyou@example.com');
Zend_Mail::setDefaultTransport($transport);

Replace "you@example.com" with your own email address.

The script should then send the email using the local mail transport agent.

Report · Jan 12, 2011

David thank you the first approach did not work but the second one did. At least I got the email with the token link. However, when I click on the link it takes me to an error page that says:

Not Found

The requested URL /WFRMA/reset.php was not found on this server.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

The reset.php file is sitting right there in the root directory. This is the reset_password.php code if it means anything in resolving this further hiccup:

<?php
session_start();
$errors = array();
$success = FALSE;
$_SESSION['nomatch'] = TRUE;
require_once('library.php');
try {
  if (isset($_GET['id']) && isset($_GET['token'])) {
     $id = $dbRead->quote($_GET['id']);
     $token = $dbRead->quote($_GET['token']);
     $sql = "SELECT user_id FROM users WHERE user_id = $id AND token = $token";
     $result = $dbRead->fetchRow($sql);
     if ($result) {
      $_SESSION['user_id'] = $_GET['id'];
       $_SESSION['token'] = $_GET['token'];
       $_SESSION['nomatch'] = FALSE;
     } 
  }
  if (isset($_POST['reset'])) {
     // password reset code goes here
     $val = new Zend_Validate();
     $val->addValidator(new Zend_Validate_StringLength(8,15));
     $val->addValidator(new Zend_Validate_Alnum());
     if (!$val->isValid($_POST['password'])) {
       $errors['password'] = 'Use 8-15 letters or numbers only';
     }
     $val = new Zend_Validate_Identical($_POST['password']);
     if (!$val->isValid($_POST['conf_password'])) {
       $errors['conf_password'] = "Passwords don't match";
     }
     if (!$errors) {
       // update the password
       $data = array('password' => sha1($_POST['password']),
                     'token'    => NULL);
       $where['user_id = ?'] = $_SESSION['user_id'];
       $where['token = ?'] = $_SESSION['token'];
       $success = $dbWrite->update('users', $data, $where);
       unset($_SESSION['user_id']);
       unset($_SESSION['token']);
       unset($_SESSION['nomatch']);
     }
  }
} catch (Exception $e) {
  echo $e->getMessage();
}
Thanks.

Report · Jan 13, 2011

conmolbry wrote:
when I click on the link it takes me to an error page that says:
Not Found
The requested URL /WFRMA/reset.php was not found on this server.
Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.
The reset.php file is sitting right there in the root directory.

Yes, but the error message tells you that it's looking for reset.php in the WFRMA directory.

The message about the 404 Not Found error simply means your site doesn't have a default error page.

Report · Jan 13, 2011

I keep getting a little further step-by-step with your help but not quite there yet. It was as you said pointing to the master WFRMA folder that housed everything in my local testing environment. Once I deleted that WFRMA reference in the path in request_reset.php and replaced the file on the remote server, I can now successfully get to the reset password page (reset.php). However, after entering and confirming the new password, I get the "Sorry, there was an error. Make sure you used the complete URL in the email you received. The URL can be used to change your password only once. If necessary, submit another request" message.

Report · Jan 15, 2011

It sounds as though the token is being truncated, either in the email or possibly in the database. The token column needs to be 32 characters wide.

Report · Jan 15, 2011

I deleted my original reply here. I'm still having some re-set problems but working on it and will check back to confirm if issues are resolved. Thanks.

Report · Jan 16, 2011

All is good, thank you so much again David.