#2700 - Force reset all member passwords feature
-
By PDStig
- Added
- 2 views
| Identifier | #2700 |
|---|---|
| Issue type | Feature request or suggestion |
| Title | Force reset all member passwords feature |
| Status | Open |
| Tags |
Type: Security (custom) |
| Handling member | Deleted |
| Addon | core |
| Description | I think a good little tool to have for Composr is the ability for site administrators to nullify every password in the Composr database and forcing every user to reset their password.
A practical application to this would be if the staff of a Composr website have reasonable suspicion that the website's security was compromised. To protect the users on the site, a quick tool to expire all passwords and force members to create a new password would be very handy. |
| Steps to reproduce | |
| Funded? | No |
The system will post a comment when this issue is modified (e.g., status changes). To be notified of this, click "Enable comment notifications".
Comments
Mention this in the tut_importer tutorial.
A future extension would be older password_hash schemes within PHP, if bcrypt becomes insecure.
If a password has been 'nullified', a user should be told so when they try to sign in - so they understand why they need to do a reset on it.