Having admin reset users password?

akacj

In my user login system, from the admin account I would like to select a user and click a button to reset their password . They will then get an email with a reset code.
Right Now I'm using a $_GET 'ID' and that is being transmitted to passreset.php , but you can see the link in the status bar. I want to be able to make it so you cant hack it
and reset all of the users password in the database.

Maybe processing all the information about the user through a session?. I just need passreset.php to know who needs to be reset.

I want the administrator to be able to manual reset the password for the user.
I also want the user to be able to reset their password on their own (I know how to do this one though)

Thanks

laserlight

akacj wrote:
Right Now I'm using a $_GET 'ID' and that is being transmitted to passreset.php , but you can see the link in the status bar. I want to be able to make it so you cant hack it
and reset all of the users password in the database.

You presumably have some way to ensure that only users with the required permission (or user level) can access a page. Use the same mechanism to ensure that only admins can access passreset.php.

akacj

yes I am using user levels.
The complete link would be
http://192.168.10.13/users.php?id=100&resettype=rp

If looked at the status bar and copied this link to the URL box then I
Could potentially reset a lot of users passwords by changing the id .
How could I avoid this even if admins only have access?

laserlight

akacj wrote:
The complete link would be
http://192.168.10.13/users.php?id=100&resettype=rp

That IPv4 address is in a private range, so presumably it is the address of the computer on your local network that you are using for testing, so it is not useful to us.

akacj wrote:
If looked at the status bar and copied this link to the URL box then I
Could potentially reset a lot of users passwords by changing the id .
How could I avoid this even if admins only have access?

Why do you want to avoid this when only admins have access? Anyway, initiating a password reset probably should be a POST request, but even so with the help of browser based web development tools I can "hack" your form with the ids of my choice... but if I'm an admin, why bother? I would just go to the user entry and click on it.