reset password with orchard not updating

Question

Using Orchard 1.6. In the settings section in the Dashboard I have enabled 'Display a link to enable users to reset their password'

After updating this feature on the server the user can now request a lost password email be sent to them which allows them to change their password. This all works fine however the new password does not take affect. and the old password still works? why is this?

thanks for any replies

Answer 1

I just had this issue. I am using Orchard 1.7.

The problems seem to come from the fact that the nonce is null when trying to modify the password, redirecting the user to the home page.

First, I modified the Orchard.Users.AccountController LostPassword controller to look like this :

 public ActionResult LostPassword(string nonce) {
        if ( _userService.ValidateLostPassword(nonce) == null ) {
            return RedirectToAction("LogOn");
        }
        ViewData["nonce"] = nonce; //add this line
        ViewData["PasswordLength"] = MinPasswordLength;

        return View();
    }

Then, you need to modify the LostPassword.cshtml and add this line within the form :

@Html.Hidden("nonce",ViewData["nonce"])

This assures that the nonce gets passed back when posting the new password and fixes the issue.

Hope this helps.

Edit: Don't forget that you need to add that line in your theme's LostPassword.cshtml file as well. If you don't you will still have this error.