I want to modify the front end, but I don’t know how to modify it

LF_Mcxixif_

SKevo
Then I think it is easier to modify the database directly

So how to modify the user's password through API?

SKevo

LF_Mcxixif_ You can't change it directly from the API and all that you can do is send a password reset E-mail for yourself. To do that, just send a PATCH request to /api/users/:id with JSON { email: <your E-mail> }. I haven't tested this yet because I'm on my mobile right now, but that's what I have on my GitHub

LF_Mcxixif_

SKevo Then I want to know, what is Flarum's password encryption method? Maybe I can modify the user's password by modifying the database.

SKevo

LF_Mcxixif_ yes, that's definitely possible. Flarum uses bcrypt for password encryption. We (FreeFlarum) use Python's bcrypt package to hash passwords and put them into database. The default settings are fine with no rounds or indent specified - Flarum handles it just fine. You might want to check how the package works though, as the default settings might be different for PHP?

Also, I recommend you to edit the database directly when creating a Flarum extension. Things are easier, as you shouldn't trust client's JS, because opening devtools allows them to send custom data. It's always better to handle it in the backend instead.

LF_Mcxixif_

SKevo What function does he use?
For example, md5(md5($password).salt) in PHP

SKevo

LF_Mcxixif_
I am not a PHP developer, so I can't help you with the PHP code, sorry. There is definitely some PHP bcrypt package that Flarum is using, you could check Flarum's dependencies and source code

LF_Mcxixif_

SKevo I made a trick myself, and use the PHP function password_hash("$password", PASSWORD_DEFAULT); to generate $2y$10$xxxxxxxxxxxxxxxxxx

After verification, it is indeed the password

clarkwinkelmann

You can use any PHP hash supported by PHP's password_hash. The first few bytes of the hash specify the algorithm and the number of rounds, and Flarum will automatically use those parameters even if it's different from Flarum's own defaults.

Any bcrypt library in another programming language should be compatible.

SKevo You can't change it directly from the API and all that you can do is send a password reset E-mail for yourself

When making the request as an admin, you can actually set the password directly. It's a very similar payload as my previous example, just PATCH /api/users/<id> with a JSON payload of data.attributes.password. When changing the password via the REST API like this you don't need to hash it, Flarum will to it from the plaintext password.

SKevo

clarkwinkelmann When making the request as an admin, you can actually set the password directly. It's a very similar payload as my previous example, just PATCH /api/users/<id> with a JSON payload of data.attributes.password. When changing the password via the REST API like this you don't need to hash it, Flarum will to it from the plaintext password.

Ah indeed, but I was assuming that the user has not the "Edit Credentials" permission, and like you mentioned - this applies only for admins (or users with the permission). But technically yes, it is possible to edit the password this way, sorry for the confusion

LF_Mcxixif_

@SKevo @clarkwinkelmann @ddeeffw @Hari @Justoverclock

Thank you very much. At present, my Flarum has started to run normally. I wrote a PHP script to synchronize the data of the two user databases. Because the passwords are encrypted, I generated a random temporary Flarum login password and notified them via email. They can provide this temporary password and change it to my master password to realize the unification of the two user database passwords.

And I also wrote a PHP script to synchronize the user database of Flarum in the registration, password modification, and password retrieval part of my main site.

Finally, these problems of mine have been resolved. Thank you very much for the support of the Flarum community!

Hari

LF_Mcxixif_ could you share code example or make an extension, did you sync the user database from wordpress?

LF_Mcxixif_

Hari Oh, I am not using Wordpress, but an account system developed by myself. If you need it, of course I can share it.

« Previous Page