XF 2.2 How to force a password reset on a large group of users?
- Thread starter dougdirac
- Start date
![[OzzModz] Security Lock Old Accounts](/community/data/resource_icons/9/9372.jpg?1707865867){kind=icon}
Chromaniac
Well-known member
you should be able to do it using batch update users manually. above addon is pretty useful to automate the process to do it regularly.
basically search for users who haven't logged on till x number of days. and then mark those accounts for reset password.
basically search for users who haven't logged on till x number of days. and then mark those accounts for reset password.
dougdirac
Active member
Does that then send an email to all of them?
Chromaniac
Well-known member
Ooh. No. They are asked to reset password next time they try to login. No mails are sent during the batch processing.
philmckrackon
Well-known member
1) Run the batch as stated but add to a user group and set password reset.
2) Mas email to the user group from Admincp.
Chromaniac
Well-known member
it is a bit confusing for me as well. i believe reset password would require user to have access to connected email account so this is better.
second option is more of a precautionary change like you just prefer if they would change their password. this would be kind of useless in case of hacked accounts.
second option is more of a precautionary change like you just prefer if they would change their password. this would be kind of useless in case of hacked accounts.
philmckrackon
Well-known member
Exactly, but no email is sent. To do so add them to a group then send the group an email.it is a bit confusing for me as well. i believe reset password would require user to have access to connected email account so this is better.
second option is more of a precautionary change like you just prefer if they would change their password. this would be kind of useless in case of hacked accounts.
philmckrackon
Well-known member
Maybe by SQL query but not XF.
philmckrackon
Well-known member
I'm not sure XF writes a tomestamp to the DB when a password is reset. You would need to look @ the xf_user table to see if it is tracked. I'm pretty sure it is not.
woody
Well-known member
In my case, thousands of users had old/bounced emails. Mass emailing might be a bigger headache than it's worth.
I did a forced password reset to over 150k members in Aug 2021, and STILL get a user every week/two that is looking to log back in, but their email is no longer accessible. Those first couple weeks were non-stop. At the 6-month point, 25k users had reset their password.
woody
Well-known member
That's exactly what happens, a password reset is automatically sent to their inbox WHEN they visit the site.
DO be sure that ALL accounts can use the "contact us"....XF fails at permissions when it comes to users that fall within the "security lock" parameters. I ended up with a dismissable notice with WHY their password no longer worked, and contact info should their email be no longer accessible.
dougdirac
Active member
Hmm... so how do you do that? I do notice the Contact Us link doesn't work for accounts that got the reset. Also how do I show a notice to just locked accounts.
Script to set same password for specific user IDs. Modify as needed:
PHP:
<?php
if (PHP_SAPI != 'cli')
{
exit();
}
ignore_user_abort(true);
$dir = __DIR__;
require($dir . '/src/XF.php');
XF::start($dir);
$app = XF::setupApp('XF\Pub\App');
// Array of user IDs to update
$user_ids = [
1, 2, ,3 ,4
];
// Password to set for all users
$newPassword = 'NEWPASS';
// Create log file
$logFile = __DIR__ . '/password_update_log_' . date('Y-m-d_H-i-s') . '.txt';
$log = fopen($logFile, 'w');
// Initialize counters
$successCount = 0;
$failCount = 0;
$notFoundCount = 0;
// Get users
$users = \XF::finder('XF:User')->whereIds($user_ids)->fetch();
foreach($users as $user)
{
try {
$auth = $user->getRelationOrDefault('Auth');
$auth->setPassword($newPassword);
$auth->save();
$message = "SUCCESS: Password updated for user ID {$user->user_id} (Username: {$user->username})";
echo $message . "\n";
fwrite($log, $message . "\n");
$successCount++;
} catch (\Exception $e) {
$message = "ERROR: Failed to update password for user ID {$user->user_id}: " . $e->getMessage();
echo $message . "\n";
fwrite($log, $message . "\n");
$failCount++;
}
}
// Write summary to log
$summary = "\nOperation Summary:\n";
$summary .= "Total users processed: " . count($user_ids) . "\n";
$summary .= "Successful updates: " . $successCount . "\n";
$summary .= "Failed updates: " . $failCount . "\n";
$summary .= "Operation Completed: " . date('Y-m-d H:i:s');
echo $summary;
fwrite($log, $summary);
// Close log file
fclose($log);
