#! code

Drupal is capable of sending out a few different emails to users depending on different actions. The emails can be customised quite nicely with usernames, passwords, email addresses and other things by using a set of tokens. The password recovery email states that you can use the "!password" token to send the user their new password, but after a few tests I found that this token doesn't get replaced when the email is sent out.

When validating a password it is easy enough to make sure that the password is of a certain length, but what happens if you want to make sure that the password has at least one number, or contains a mixture of upper and lowercase letters? I recently had to validate a password like this and so I created a password validation class that allows easy validation of a password string to a set of given parameters, but also allow these parameters to be changed when needed.

A small exploit has been found within the latest (currently 2.8.3) version of Wordpress that can cause any attacker to reset the admin password. The attacker won't be able to see what the password is, and the new password is emailed to you anyway, but it might cause some users to be locked out of their blogs if they can't get access to the email or their email is down. However, it is a real pain so I am writing this blog to allow other bloggers to fix their Wordpress installs.

I have talked about generating random passwords before. Although that function generated some nice passwords, they perhaps aren't as unique as they ought to be.

This function, take from Webtoolkit creates passwords of different length with varying levels of complexity.

If for some reason you can't remember your Wordpress password and you can't use the "lost your password" function that comes with Wordpress, due to problems with email, then you can use the following SQL command to reset your password.

Here is a very simple function that will generate a string of random characters, ideal if you want to create a password for a new user.

function generatePassword($length=10)
{
 $pass = '';
 $parts = array_merge(range(0, 9),range('a', 'z'),range('A', 'Z'));	
 for ($i=0; strlen($pass) <= $length; $i++) {
  $pass .= $parts[array_rand($parts)];
 }
 return $pass;
}

Use the function like this.