When writing [security] Forgot password for Administrators [5.3.0-B1] I've also reviewed how current "Forgot Password" system works on Front-End. Honestly I was quite shocked by how the misleading password reset instructions are.
Current password reset workflow looks like this:
User Action | Screenshot | Problem | Solution (Changes to be made) |
---|
user clicks on the "Forgot password?" link at the bottom of login sidebox | | Link font is quite small, but that's not misleading really. | no changes |
user sees the first forgot password wizard step | | - The message says, that user account information will be sent to e-mail that he mentioned in his account. This is not correct, because In-Portal won't ever send user account information over e-mail.
- The button says "Recover Password". This is not correct, because In-Portal doesn't help user to recover his existing password. Instead one time password change link is e-mail to the user.
- The page title says "Forgot Password". This is correct, but misleading as well, because it doesn't tell to the user, that:
- this is forgot password wizard
- wizard consists of 3 steps and this is 1st step
Following navigation bar would be in order: "Home > Forgot Password? > Step 1 of 3". | - change text to ""
- change button to ""
- change Page title to "Forgot Password (Step 1 of 4)"
|
once user enters his username/e-mail and presses "Recover Password" button (or presses ENTER): - the confirmation screen is shown
- the e-mail is sent out to the user
| | - The message says, that user will receive new password if he/she follows the link in e-mail that was sent. This is not correct, because once link in e-mail is clicked user will be forwarded to password change form, where he/she can enter new password.
- The text after the link says, that user will receive the second e-mail containing his/her new password. This is not correct, because:
- no second e-mail will be sent
- user will be able to enter his new password right on the page that is opened by provided link.
- The last sentence says, that your password will be changed once above link is clicked. This is not correct because password only will be changed if on page (from the link) user will choose to save his new password.
Following navigation bar would be in order: "Home > Forgot Password? > Step 2 of 3".
| - change text (An automatic email has...) to "An automatic email has been sent to your email on file. please follow the link in that email to set your new password"
- REMOVE "OK" button - no needed
- change Page title to "Forgot Password (Step 2 of 4)"
- change email to ready this:
====== Hello,<br/><br/> It seems that you have requested a password reset for your account. If you would like to proceed change of your old password, please click on the link below:<br/><br/> <a href="<inp2:u_ConfirmPasswordLink no_amp="1"/>"><inp2:u_ConfirmPasswordLink no_amp="1"/></a><br/><br/> Once clicked, you'll be taken to taken to the page where you can set your new password.<br/><br/> If you believe you have received this email in error, please ignore this email. Your password will not be changed unless you successfully the above link. ======
|
once user clicked on a link, then he sees password change form | | - The page title says "Password Request Confirmation". This is incorrect because nobody confirms, that he/she is requested password on this page.
- Text above password fields says, that user needs to confirm, that he/she wants to reset a password. This is incorrect, because we're on form, where new password should be entered. There is no need to confirm anything at this point.
- The password field labels are the same as on "My Profile" page ("Password" and "Verify Password"). This is incorrect, because this isn't user existing password, but the new password and confirmation of his/her new password.
- The button below the form says "Update". This too general title for form, that is only designed for new password entry.
- User isn't logged-in, when using this form, which is strange, because password reset link must auto-login user and then allow him/her to change password.
Following navigation bar would be in order: "Home > Forgot Password? > Step 3 of 3". | - change Page title to "Forgot Password (Step 3 of 4)"
- change text below title to "Please enter your new password"
- change labels to be "New Password" and "" - make sure no wrapping
- change button to ""
- I am not sure if we need to auto-login the user - I guess we can if it's NOT too hard.
|
once user presses "Update" button he'll sees confirmation window | | - The page title says: "Forgot Password Confirmation". This is incorrect because we're not confirming, that we've forgotten the password, but instead confirming that password was updated successfully.
- The text says: "Your password has been reset. The new password has been sent to your e-mail address. You may now login with the new password.". This is incorrect because:
- password was updated instead of reset
- password wasn't sent to email
- user is logged-in automatically
| - change Page title to "New Password Confirmation (Step 4 of 4)"
- change text below title to "Your password has been successfully changed."
|
Solution
- add these new phrases:
- "lu_title_ForgotPasswordStep1" with "Forgot Password (Step 1 of 4)" translation
- "lu_title_ForgotPasswordStep2" with "Forgot Password (Step 2 of 4)" translation
- "lu_title_ForgotPasswordStep3" with "Forgot Password (Step 3 of 4)" translation
- "lu_title_ForgotPasswordStep4" with "Forgot Password (Step 4 of 4)" translation
- "lu_btn_Continue" with "Continue" translation
- "lu_text_ForgotPassResetChangeForm" with "Please enter your new password" translation
- "lu_fld_NewPassword" with "New Password" translation
- "lu_fld_VerifyNewPassword" with "Repeat New Password" translation
- "lu_btn_SetNewPassword" with "Set New Password" translation
- change translation of "lu_EnterForgotUserEmail" phrase to "Enter your Username or Email below to continue with resetting your password."
- on "/themes/advanced/platform/login/forgot_password.tpl" template:
- use "lu_btn_Continue" phrase instead of "lu_btn_SendPassword" phrase (1 place)
- use "lu_title_ForgotPasswordStep1" phrase instead of "lu_title_ForgotPassword" phrase (3 places)
- in "lu_text_ForgotPassResetEmailSent" phrase change "Please follow the link in the email in order to receive a new password." to "Please follow the link in that email to set your new password."
- on "/themes/advanced/platform/login/forgot_password_reset_notice.tpl" template:
- use "lu_title_ForgotPasswordStep2" instead of "lu_title_ForgotPasswordNotification" (3 places)
- replace "<form" containing OK button with just "lu_text_ForgotPassResetEmailSent" phrase translation
- in "USER.PSWDC" e-mail template html translation replace:
- "your In-portal account" with "your account"
- [new] "If you would like to proceed and change the password" with "If you would like to proceed with the change of your old password"
- "You will receive a second email with your new password shortly." with "Once clicked, you'll be taken to taken to the page where you can set your new password."
- "Your password will not be changed unless you have clicked on the above link." with "Your password will not be changed unless you successfully change it by following the above link."
- on "/themes/advanced/platform/login/forgot_password_reset.tpl" template:
- use "lu_title_ForgotPasswordStep3" phrase instead of "lu_title_PasswordRequestConfirm" (3 places)
- use "lu_text_ForgotPassResetChangeForm" phrase instead of "lu_text_PasswordRequestConfirm" form
- use "lu_fld_NewPassword" instead of "lu_fld_Password" phrase
- use "lu_fld_VerifyNewPassword" instead of "lu_fld_VerifyPassword" phrase
- use "lu_btn_SetNewPassword" instead of "lu_btn_Update" phrase
- change translation of "lu_text_ForgotPassHasBeenReset" phrase to be "Your password has been successfully changed."
- on "/themes/advanced/platform/login/forgot_password_reset_confirm.tpl" template:
- use "lu_title_ForgotPasswordStep4" phrase instead of "lu_title_ForgotPasswordConfirm" (3 places)
INP-1683
-
Getting issue details...
STATUS