/// -----------------------------------------------------------------------------
/// <summary>
/// ChangePassword attempts to change the users password
/// </summary>
/// <remarks>
/// </remarks>
/// <param name="user">The user to update.</param>
/// <param name="oldPassword">The old password.</param>
/// <param name="newPassword">The new password.</param>
/// <returns>A Boolean indicating success or failure.</returns>
/// -----------------------------------------------------------------------------
public override bool ChangePassword(UserInfo user, string oldPassword, string newPassword)
{
MembershipUser aspnetUser = GetMembershipUser(user);
var m = new MembershipPasswordController();
if (m.IsPasswordInHistory(user.UserID, user.PortalID, newPassword))
{
return false;
}
if (string.IsNullOrEmpty(oldPassword))
{
aspnetUser.UnlockUser();
oldPassword = aspnetUser.GetPassword();
}
bool retValue = aspnetUser.ChangePassword(oldPassword, newPassword);
if (retValue && PasswordRetrievalEnabled && !RequiresQuestionAndAnswer)
{
string confirmPassword = aspnetUser.GetPassword();
if (confirmPassword == newPassword)
{
user.Membership.Password = confirmPassword;
}
else
{
retValue = false;
}
}
return retValue;
}
/// <summary>
/// overload will validate the token and if valid change the password
/// it does not require an old password as it supports hashed passwords
/// </summary>
/// <param name="newPassword">The new password.</param>
/// /// <param name="resetToken">The reset token, typically supplied through a password reset email.</param>
/// <returns>A Boolean indicating success or failure.</returns>
public static bool ChangePasswordByToken(int portalid, string username, string newPassword, string resetToken)
{
bool retValue;
Guid resetTokenGuid = new Guid(resetToken);
var user=GetUserByName(portalid, username);
//if user does not exist return false
if (user==null)
{
return false;
}
//check if the token supplied is the same as the users and is still valid
if (user.PasswordResetToken != resetTokenGuid || user.PasswordResetExpiration < DateTime.Now)
{
return false;
}
var m = new MembershipPasswordController();
if (m.IsPasswordInHistory(user.UserID, user.PortalID, newPassword))
{
return false;
}
//Although we would hope that the caller has already validated the password,
//Validate the new Password
if (ValidatePassword(newPassword))
{
retValue = MembershipProvider.Instance().ResetAndChangePassword(user, newPassword);
//update reset token values to ensure token is 1-time use
user.PasswordResetExpiration = DateTime.MinValue;
user.PasswordResetToken = Guid.NewGuid();
//Update User
user.Membership.UpdatePassword = false;
UpdateUser(user.PortalID, user);
}
else
{
throw new Exception("Invalid Password");
}
return retValue;
}