Password reset for users

[robkir]

My ISP is not happy that my password reset routine sends an email with a link and token to clients who have forgotten their password. The ISP's concern is that a spammer could spam any email address through the password reset module. I set up a google captcha to protect the password reset page, but I am wondering if there is a better way to handle this situation. I like emailing the client because I feel it is more secure for the client.

I've been nosing around and most everybody seems to be using email for this routine.

Any ideas would be most welcome.

robkir

[traq]

If your ISP is concerned about spam, you might limit the reset attempts to a few per day.

But you're right, it's a quite common practice. Is there a reason your ISP even cares? Has someone been using your password reset recklessly?

[robkir]

I actually don't think any spammers have used the password reset to spam. The question came up because one of my users never received the system generated email with the token. Upon investigation we determined that the users email provider (road runner) had blocked email from my ISP.

Thanks for the suggestion of limiting the number of attempts.

[cretaceous]

If you 've built the reset process correctly it shoudn't be possible for a spammer to subvert it.
You're sending a pre-formatted message to an email address that already exists in your database - the only input required is email address and you only send a message if that email matches what is in your db - so what is the ISP's worry?

[robkir]

The password reset does look up the user's email and if it is in the database, it will send an email. I think the ISPs worry is that a spammer could resend that email over and over. I am thinking of putting a cap on the number of times it can be accessed in a five minute window. I also stuck a captcha in front of the password reset screen. Anything else I should include?

[cretaceous]

I guess they're worried about ddos attacks. Traq's idea sounds good but you'll need to make it clear to users that it only works for x attempts per hour so they don't think it's broken. Users seem to go mad when they can't get their reminders fast!

[robkir]

I am sure they are worried about attacks...so am I.

I had a lazy programmers idea to float. I could fool around with a time out after 5 minutes of trying. But why not just put a user's cap on the number of times he/she can try? Say, 10 tries and the user is locked out with instructions of how to reach the webmaster. I don't have a huge amount of traffic at these sites and several of modules are seasonal (soccer tournament software). I also keep track of password resets and usually people only have to reset their passwords once or twice. I kinda like it.

[sneakyimp]

Your password reset script may not be as secure as you think -- it could be an accidental open relay. Without seeing your script, it's impossible to say.

alternatively, the form that users interact with to trigger the password reset action might also be vulnerable to spamming -- wherein a spammer uses your script to ask for a password reset for your customers and somehow adds spam links or links to malware, exploits, etc.

[sneakyimp]

Also, you could alter your script so that it uses PEAR::Mail or some other mail client to send outgoing mail through a gmail account or something. This approach will be limited in how much mail it can send and it may not be feasible for performance reasons, but it can dramatically improve mail deliverability.

[robkir]

sneakyimp;11025197 wrote:

Also, you could alter your script so that it uses PEAR::Mail or some other mail client to send outgoing mail through a gmail account or something. This approach will be limited in how much mail it can send and it may not be feasible for performance reasons, but it can dramatically improve mail deliverability.

Really? Through Gmail? That would solve another headache in that my ISP's script generated email occasionally gets banned at destinations like road runner or verizon email addresses. I went looking for the PEARS package and, I hate to admit..., I can't find that module, or even figure out how to download a PEARS module. Some direction would be mightily appreciated.

[robkir]

Here's the code I use to help users reset their passwords (I edited out the extraneous stuff )
The first module has the user enter his email address for verification that he is in the database. It changes his old pw to a random string and sends him an email with a link and a token. The second module, access through the link and token, passwordChange.php, lets him rename it whatever he wants. I only posted the first module, since I believe that's where the vulnerability is.

	/*-----------------------------------------------------------------------------------------|	
	 *	
	 * 	Name of file   passwordForgot.php
	 *	Creation date
	 * 	Update         12/11/2012 6:08:41 PM
	 * 	Program Details
	 * 	Goes To
	 * 	
	 * 	
	 * 	author: bk
	 * 	tm software
	 * 	
	 *----------------------------------------------------------------------------------------*/ 	



// randomize replacement password 
// The $_POST['email_get'] comes from the previous page where the user types in his email address. it is checked against the database to be sure that he/she is actually registered. 

if ($_POST['email_get'])
{function createRandomPassword() { 

$chars = "abcdefghijkmnopqrstuvwxyz023456789"; 
srand((double)microtime()*1000000); 
$i = 0; 
$pass = '' ; 


while ($i <= 7) { 
    $num = rand() % 33; 
    $tmp = substr($chars, $num, 1); 
    $pass = $pass . $tmp; 
    $i++; 
} 


return $pass; 

} 

// Usage 
$tempPassword = createRandomPassword(); 


}

echo  "<span class='small_type'><form method='post' action ='' name='newPW'>
      Email Address&nbsp;</span><span class='text_reg'>
      <input type='text' name='email_get' /><br />
      </span><input name='Submit1' type='submit' value='submit'></form></p>"; 



//---| TABLE OPEN TEAM INFO DATABASE


	$query = "SELECT * FROM admin_coach 
	WHERE email = '".$_POST['email_get']."' 
      	AND tourn_ID='".$_SESSION['tourn_ID']."'   
        	LIMIT 1";
          	$result=mysqli_query($cxn, $query) OR DIE ("Select L81 ");

		if (mysqli_num_rows($result) == 1) 
		{
			$info=mysqli_fetch_assoc($result);


		$coachID = $info['idUser'];
			$nameF = $info['nameF'];
			$nameL = $info['nameL'];
			$coachName = $nameF . " " . $nameL ; 
			$userName = $info['userName'];
			$email_current = $info['email'];
			$emailInEnglish = $info['email'];

			$email_current = (sha1($info['email']));
    			$newPassword = (sha1($tempPassword));



		$query2 = "UPDATE admin_coach SET 
        userPass = '$newPassword'
            WHERE idUser = '".$coachID."' 
            AND tourn_ID='".$_SESSION['tourn_ID']."'
                  LIMIT 1";
	mysqli_query($cxn, $query2) or die (mysqli_error($cxn)); 

		}	

// UPDATE the table with a TEMPORARY password

 if($_POST['email_get'])

	{	 	
  echo "<span class='xx_small_text'>UPDATE $coachID</span>"; 
  if(empty($coachID)){echo "<span class='redHead'>ERROR: email does not exist in database. Please try again. If you cannot remember your email address contact webmaster with your coaches first and last name, region, and division.</span>";}

	}
// SET UP NEW PASSWORD and LINK 
$faa="?pw=$newPassword&tourn_ID=".$_SESSION['tourn_ID']." \r\n";

$foo= ../coaches/passwordChange.php$faa";

// EMAIL TO USER WITH PASSWORD RESET INFORMATION 
$userNameExist= $info['userName'];
$sayWhat="
To: $coachName

Your password for the ".$_SESSION['tournName'] ." has been reset and a temporary password has been created. To change it to something more meaningful (and easier to remember) click on the highlighted link below. IF THE LINK IS NOT HIGHLIGHTED simply copy and paste it into your browser.  

$foo

Please make a note of your user name:::: $userNameExist \r\n

NOTE: D0 NOT REPLY TO THIS EMAIL. It is an unmonitored email address. For specific questions CONTACT ". $_SESSION['webmasterEmail'];


// EMAIL TO WEBMASTER TO NOTIFY THAT A USER HAS RESET HIS PASSWORD acts as a canary.Lots of emails says there is a prob.
if($_POST['email_get'] AND $userNameExist){

$to = $_POST['email_get'];
$subject = $_SESSION['tournName'] . " reset password";
$message = $sayWhat;
$from = $_SESSION['regionWeb'];
$headers="From: $from";

mail($to,$subject,$message,$headers);

//notifies me that a password has been changed


$to = $_SESSION['webmasterEmail']; 
$subject = $_SESSION['tournName']. " . A user has reset password";
$message = "user " . $coachID . "reset password";
$from = $_SESSION['regionWeb'];
$headers="From: $from";

mail($to,$subject,$message,$headers);

}  

// MESSAGE POPS UP FOR USER TO SEE. CONFIRM WE SENT AN EMAIL.
  if($_POST['email_get'] and $userNameExist) 
	{
		echo "<table border=\"2\" width=\"60%\">
            <tr>
              <td><span class=\"small_type redHead\">An email has been sent to you. Please check your email. If you do not see an email from </span>" . $_SESSION['tournName'] . "<span class=\"redHead\"> 
		check your SPAM email. <br />If you still can't find it please notify the
		<a href='mailto:".$_SESSION['webmasterEmail']. "?subject=trouble resetting password for".$_SESSION['tournName']."'>webmaster</a></span></td>
            </tr></table>";
	}

echo "<br /><br /><a href='userlogin_coach.php'>Cancel and Return to Enter Password </a>";
?>

[sneakyimp]

PEAR::Mail is pretty easy to find[/ur]. There's a [url=http://pear.php.net/package/Mail/download]download link right there on the page. There are two general approaches to installing PEAR::Mail on your server:
1) Manually download the Mail module and any other modules that it relies on like Net_SMTP or Net_Socket and then put them in your web root, include each file and then get started with a scdript
2) If you have root access to your server, you can install it using a package manager or perhaps use the pear command to install each module.

Once you have the module(s) installed, try this:

    // code that follows requires you to have PEAR mail installed    

try {
    // require the pear Mail module
    require_once "Mail.php";

// this is the message you want to send
$message = "Yo bro how you doin?";

$params = array(
    "host" => "smtp.gmail.com",
    "port" => 587,
    "auth" => TRUE,
    "username" => "[e-mail]",
    "password" => "your_password",
    "debug" => TRUE
);
$smtp = Mail::factory('smtp', $params);
if (PEAR::isError($smtp)){
    throw new Exception("Unable to create pear MAIL object");
}
$headers = array(
    "From" => "[e-mail]",
    "Sender" => "[e-mail]",
    "Reply-to" => "[e-mail]"
);
$send_result = $smtp->send("[e-mail]", $headers, $message);
if ($send_result !== TRUE){
    echo "send failure:\n";
    var_dump($send_result);
    echo "\n\n";
}

echo "\n\nTHAT IS ALL\n\n";
} catch (Exception $e) {
    echo "error:" . $gpg->geterror();
    die("Exception:" . $e->getMessage());
} 

Alternatively, you could try SwiftMailer or PHPMailer. These are basically PHP mail client libraries that let you connect to a remote server to send mail. Some are better than others. I've had good experiences with PEAR::Mail myself.

[sneakyimp]

I'm not certain, but it looks to me like your script might be vulnerable to header injection? You should never take user input (e.g., $_POST['email_get']) and just feed it to any database query or email action without first validating it.

For $_POST['email_get'], you should use [man]filter_var[/man] to make sure it is in fact a valid email address. For any user input that you use to construct a query, you should use [man]mysqli_real_escape_string[/man] instead of just putting it in your query to prevent sql query injection.

[robkir]

Turns out that PEARS is already installed on the ISP's site. I was able to run the routine to test it...but it failed. It looks like all I needed to change in your testing module was the username, password and $send_result destination. Am I missing something else that is obvious?

[robkir]

Whoa...I can't believe I left FILTER_VALIDATE_EMAIL and mysqli_real_escape_string out. Good catch. Thanks.

[sneakyimp]

I can't be sure exactly why it failed but yes if you don't change the email addresses, username, password, etc. then of course it will fail because those are not real gmail credentials. The script could be improved in that you could specify each value once in a constant or variable and then use that const/variable rather than typing "[e-mail]" in four different places.

That's nice of your ISP to install PEAR. It's got some good stuff.

[sneakyimp]

robkir;11025217 wrote:

Whoa...I can't believe I left FILTER_VALIDATE_EMAIL and mysqli_real_escape_string out. Good catch. Thanks.

This should be second nature to any PHP dev. If there's any chance that a $var contains user input ($GET, $POST, $COOKIE, $SESSION, a file, data that was stored in a db previously, etc.) then you should always be wary of it. AFAIK, pretty much every exploit that exists is where a program accepts user input. Q.v.: Buffer overflow.

[robkir]

Hey sneakyimp,
I've spent wayyyyy to much time trying to figure this out and I must be missing something really obvious. Do I have to do anything on the gmail side? Push a button or click a box? I didn't see anything. There must be something weird in my code. Any help you could give would make you a hero...

require_once "Mail.php";

  require_once "Mail.php";

    $from = "<robkir.gmail.com>";
    $to = "<robkir.yahoo.com>";
    $subject = "Hi!";
    $body = "Hi,\n\nHow are you?";

    $host = "ssl://smtp.gmail.com";
    $port = "465";
    $username = "robkirsUserName";  //<> give errors
    $password = "robkirsPassword";

    $headers = array ('From' => $from,
      'To' => $to,
      'Subject' => $subject);
    $smtp = Mail::factory('smtp',
      array ('host' => $host,
        'port' => $port,
        'auth' => true,
        'username' => $username,
        'password' => $password));

    $mail = $smtp->send($to, $headers, $body);

    if (PEAR::isError($mail)) {
      echo("<p>" . $mail->getMessage() . "</p>");
     } else {
      echo("<p>Message successfully sent!</p>");
     }

[sneakyimp]

First problem: you require_once the same file twice.
Second problem: you changed the $host and $port. my script. which works, uses a different port and host.
third problem: $from is not a valid email address (no ampersand)
fourth problem: $username is not an email address (although I'm not sure it has to be, it is in my script, which works)
fifth problem: $to is also not a valid email address (no ampersand)

If it doesn't work, what does its output look like? You should get a reasonably informative message if there is a failure.

You can also set debug=TRUE for Pear::mail to get a lot more detail. This is extremely helpful as it causes PEAR::Mail to echo out all kinds of verbose detail about its progress:

    $params = array(
        "host" => "smtp.gmail.com",
        "port" => 587,
        "auth" => TRUE,
        "username" => "[e-mail]",
        "password" => "your_password",
        "debug" => TRUE
    );

Note the last element of $params.

[robkir]

When I couldn't get yours to work, I went internet surfing...now that I've learned a few things, I am back with your script. But...no joy. I got the following failure message:

send failure: object(PEAR_Error)#4 (8).

Debug was on and it kicked out a whole slew of errors including a failure to connect at prot 587

send failure: object(PEAR_Error)#4 (8) { ["error_message_prefix"]=> string(0) "" ["mode"]=> int(1) ["level"]=> int(1024) ["code"]=> int(10001) ["message"]=> string(117) "Failed to connect to smtp.gmail.com:587 [SMTP: Failed to connect socket: Connection timed out (code: -1, response: )]" ["userinfo"]=> NULL ["backtrace"]=> array(4) { [0]=> array(6) { ["file"]=> string(51) "/hsphere/shared/apache/libexec/php5ext/php/PEAR.php" ["line"]=> int(533) ["function"]=> string(10) "PEAR_Error" ["class"]=> string(10) "PEAR_Error" ["type"]=> string(2) "->" ["args"]=> array(5) { [0]=> string(117) "Failed to connect to smtp.gmail.com:587 

If you have time, here's another look. Hope we can solve the problem. This sounds like a very good tool for me.

  // code that follows requires you to have PEAR mail installed    

try {
    // require the pear Mail module
    require_once "Mail.php";

// this is the message you want to send
$message = "Yo bro how you doin?";

$params = array(
    "host" => "smtp.gmail.com",
    "port" => 587,
    "auth" => TRUE,
    "username" => "robkirUserName",
    "password" => "robkirPassword",
    "debug" => TRUE
);
$smtp = Mail::factory('smtp', $params);
if (PEAR::isError($smtp)){
    throw new Exception("Unable to create pear MAIL object");
}
$headers = array(
    "From" => "[e-mail]",
    "Sender" => "[e-mail]",
    "Reply-to" => "[e-mail]"
);
$send_result = $smtp->send("[e-mail]", $headers, $message);
if ($send_result !== TRUE){
    echo "send failure:\n";
    var_dump($send_result);
    echo "\n\n";
}

echo "\n\nTHAT IS ALL\n\n";
} catch (Exception $e) {
    echo "error:" . $gpg->geterror();
    die("Exception:" . $e->getMessage());
}  

My gmail username doesn't include the @gmail, but I tried that variation, just in case.

Interesting stuff, thanks for turning me on to it.

robkir