A simple plugin that adds a password reset facility to the WordPress REST API using a code. The process is a two step process:
A simple plugin that adds a password reset facility to the WordPress REST API using a code. The process is a two step process:
It is also possible to check the validity of a code without resetting the password which enables the possibility of setting the password by other means, or having a two stage process for checking the code and resetting the password if desired.
Default settings are to use an 8 digit code consisting of numbers, upper and lower case letters and special characters, which has a life span of 15 minutes, afterwhich a new code would need to be requested. By default a user can attempt to use or validate a code up to 3 times before automatically invalidating it.
The plugin adds two new endpoints to the REST API:
Endpoint: /wp-json/bdpwr/v1/reset-password
— HTTP Verb: POST
— Parameters (all required):
— email
/wp-json/bdpwr/v1/set-password
— HTTP Verb: POST
— Parameters (all required):
— email
— password
— code
/wp-json/bdpwr/v1/validate-code
— HTTP Verb: POST
— Parameters (all required):
— email
— code
$.ajax({ url: '/wp-json/bdpwr/v1/reset-password', method: 'POST', data: { email: '[email protected]', }, success: function( response ) { console.log( response ); }, error: function( response ) { console.log( response ); }, });
$.ajax({ url: '/wp-json/bdpwr/v1/set-password', method: 'POST', data: { email: '[email protected]', code: '1234', password: 'Pa$$word1', }, success: function( response ) { console.log( response ); }, error: function( response ) { console.log( response ); }, });
$.ajax({ url: '/wp-json/bdpwr/v1/validate-code', method: 'POST', data: { email: '[email protected]', code: '1234', }, success: function( response ) { console.log( response ); }, error: function( response ) { console.log( response ); }, });
{ "data": { "status": 200 }, "message": "A password reset email has been sent to your email address." }
{ "data": { "status": 200 }, "message": "Password reset successfully." }
{ "data": { "status": 200 }, "message": "The code supplied is valid." }
{ "code": "bad_email", "message": "No user found with this email address.", "data": { "status": 500 } }
{ "code": "bad_request", "message": "You must request a password reset code before you try to set a new password.", "data": { "status": 500 } }
{ "code": "bad_request", "message": "The reset code provided is not valid.", "data": { "status": 500 } }
A number of WordPress filters have been added to help customise the process, please feel free to request additional filters or submit a pull request with any that you required.
add_filter( 'bdpwr_code_length' , function( $length ) { return 4; }, 10 , 1 );
add_filter( 'bdpwr_code_expiration_seconds' , function( $seconds ) { return 900; }, 10 , 1 );
add_filter( 'bdpwd_date_format' , function( $format ) { return 'H:i'; }, 10 , 1 );
add_filter( 'bdpwr_code_email_subject' , function( $subject ) { return 'Password Reset'; }, 10 , 1 );
add_filter( 'bdpwr_code_email_text' , function( $text , $email , $code , $expiry ) { return $text; }, 10 , 4 );
add_filter( 'bdpwr_max_attempts' , function( $attempts ) { return 3; }, 10 , 4 );
add_filter( 'bdpwr_include_letters' , function( $include ) { return false; }, 10 , 4 );
add_filter( 'bdpwr_selection_string' , function( $string ) { return '0123456789'; }, 10 , 4 );
add_filter( 'bdpwr_allowed_roles' , function( $roles ) { $key = array_search( 'administrator' , $roles ); if( $key !== false ) { unset( $roles[ $key ] ); } return $roles; }, 10 , 1 );
add_filter( 'bdpwr_route_namespace' , function( $route_namespace ) { return 'xyz/v1'; }, 10 , 1 );
Please report security bugs found in the source code of the bdvs-password-reset plugin through the Patchstack Vulnerability Disclosure Program. The Patchstack team will assist you with verification, CVE assignment, and notify the developers of this plugin.
Report a security vulnerability.