/// ----------------------------------------------------------------------------- /// <summary> /// ChangePassword attempts to change the users password /// </summary> /// <remarks> /// </remarks> /// <param name="user">The user to update.</param> /// <param name="oldPassword">The old password.</param> /// <param name="newPassword">The new password.</param> /// <returns>A Boolean indicating success or failure.</returns> /// ----------------------------------------------------------------------------- public override bool ChangePassword(UserInfo user, string oldPassword, string newPassword) { MembershipUser aspnetUser = GetMembershipUser(user); var m = new MembershipPasswordController(); if (m.IsPasswordInHistory(user.UserID, user.PortalID, newPassword)) { return false; } if (string.IsNullOrEmpty(oldPassword)) { aspnetUser.UnlockUser(); oldPassword = aspnetUser.GetPassword(); } bool retValue = aspnetUser.ChangePassword(oldPassword, newPassword); if (retValue && PasswordRetrievalEnabled && !RequiresQuestionAndAnswer) { string confirmPassword = aspnetUser.GetPassword(); if (confirmPassword == newPassword) { user.Membership.Password = confirmPassword; } else { retValue = false; } } return retValue; }
/// <summary> /// overload will validate the token and if valid change the password /// it does not require an old password as it supports hashed passwords /// </summary> /// <param name="newPassword">The new password.</param> /// /// <param name="resetToken">The reset token, typically supplied through a password reset email.</param> /// <returns>A Boolean indicating success or failure.</returns> public static bool ChangePasswordByToken(int portalid, string username, string newPassword, string resetToken) { bool retValue; Guid resetTokenGuid = new Guid(resetToken); var user=GetUserByName(portalid, username); //if user does not exist return false if (user==null) { return false; } //check if the token supplied is the same as the users and is still valid if (user.PasswordResetToken != resetTokenGuid || user.PasswordResetExpiration < DateTime.Now) { return false; } var m = new MembershipPasswordController(); if (m.IsPasswordInHistory(user.UserID, user.PortalID, newPassword)) { return false; } //Although we would hope that the caller has already validated the password, //Validate the new Password if (ValidatePassword(newPassword)) { retValue = MembershipProvider.Instance().ResetAndChangePassword(user, newPassword); //update reset token values to ensure token is 1-time use user.PasswordResetExpiration = DateTime.MinValue; user.PasswordResetToken = Guid.NewGuid(); //Update User user.Membership.UpdatePassword = false; UpdateUser(user.PortalID, user); } else { throw new Exception("Invalid Password"); } return retValue; }