hi,

I want to store dnn passwords hashed in stead of encrypted.

Will dnn user still be able to reset their passwords using the forgot password link in the login control?

Thanks in advance

I compared the \Users\Password.ascx.vb code to the \Security\SendPassword.ascx.vb code and found that the resetPassword functionality:

Private Sub cmdReset_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles cmdReset.Click

            Dim answer As String = ""
            If MembershipProviderConfig.RequiresQuestionAndAnswer And Not IsAdmin Then
                If txtAnswer.Text = "" Then
                    OnPasswordUpdated(New PasswordUpdatedEventArgs(PasswordUpdateStatus.InvalidPasswordAnswer))
                    Exit Sub
                End If
                answer = txtAnswer.Text
            End If

            Try
                UserController.ResetPassword(User, answer)
                OnPasswordUpdated(New PasswordUpdatedEventArgs(PasswordUpdateStatus.Success))
            Catch exc As ArgumentException
                OnPasswordUpdated(New PasswordUpdatedEventArgs(PasswordUpdateStatus.InvalidPasswordAnswer))
            Catch ex As Exception
                OnPasswordUpdated(New PasswordUpdatedEventArgs(PasswordUpdateStatus.PasswordResetFailed))
            End Try

        End Sub

Is missing in \Secuirty\SendPassword.ascx.vb (it only checks for passwordRetrieval is enabled, not passwordReset is enabled):

Dim objUser As UserInfo = UserController.GetUserByName(PortalSettings.PortalId, txtUsername.Text, False)
                    If Not objUser Is Nothing Then
                        If MembershipProviderConfig.PasswordRetrievalEnabled Then
                            Try
                                objUser.Membership.Password = UserController.GetPassword(objUser, txtAnswer.Text)
                            Catch ex As Exception
                                canSend = False
                                strMessage = Localization.GetString("PasswordRetrievalError", Me.LocalResourceFile)
                            End Try
                        Else
                            canSend = False
                            strMessage = Localization.GetString("PasswordRetrievalDisabled", Me.LocalResourceFile)
                        End If
                        If canSend Then
                            Try
                                Mail.SendMail(objUser, MessageType.PasswordReminder, PortalSettings)
                                strMessage = Localization.GetString("PasswordSent", Me.LocalResourceFile)
                            Catch ex As Exception
                                canSend = False
                            End Try
                        End If
                    Else
                        strMessage = Localization.GetString("UsernameError", Me.LocalResourceFile)
                        canSend = False
                    End If

Is the password reset functionality intentionally left out in forgot password when using Hashed passwords? It is available to the admin/host user in the user management pages. Maybe I'm missing out something here or is this missing functionality in the core? (I guess the forgot password link should at least inform the user that passwordReset is not possible when using hashed passwords )


Thanks in advance

Thanks!

I know hashing is irreversible, and users can never retrieve their passwords.  I do want them to be able to reset their passwords.

Can I conclude from your post that when I enable the challange / answer sequence by changing requiresQuestionAndAnswer to True in web.config users themselves can reset their password?

Thanks in advance