Temporary Passwords by BOP5 (Allow admins to login as any user without user password)
 

Brought to you by BirdOPrey5 / Qapla.com

The purpose of this mod is to allow a site Super Administrator to login as any other user on the forum for troubleshooting purposes.

I know there are other mods that allow Admins to login as other users but they aren't truly logged in as the other user. It's more like they are getting a copy of the user's permissions ans settings. This is good for many things but it is not 100% exact and therefore can cause its own problems when trying to troubleshoot issues.

This mod is different. On the user's setting page in the Admin CP is a new box "Temporary Password" where an admin can enter a temporary one-time use password. When they save the user settings the user's old password is copied (while remaining encrypted) to another location and the temporary password they created becomes the user's new password.

As soon as possible they should then log in as the user with the password they set.

As soon as the Admin (or anyone) has logged in successfully with the temporary password the user's old password is restored and the temporary password is deleted.

In the mean time the Admin will continue to be able to use the forum as the user so long as they don't log out. If they do inadvertently log out they can set another temp password and log back in.

Due to the nature of the mod you should aways use the temp password as soon as possible- if you wait and the user tries to login when the temporary password is set they won't be able to.

I suggest using a 2nd web browser when using this. For example in Chrome you are logged in as yourself (Admin Account) but you use Firefox to log into the user's account. This allows you to quickly switch between accounts to troubleshoot.

If you change your mind and don't need the temp password after all simply return to the user's settings page in Admin CP and delete the temporary password and save changes. The user's original password will be restored.

If you uninstall the mod any temporary passwords you had set will be automatically undone and the user's original passwords restored.

There are no settings for this mod. Install it and it is active.

Only Super-Administrators specified in the config.php file can set or see temporary passwords, other admins will not be able to set or see temp passwords, the box just won't be there.

Compatible with VB 3.8.x & VB 4.x.x.

------------------------------------------------------

Please "Mark as Installed" if you use this. :)
Donations always appreciated. :up:
Nominate MOTM if you LOVE it! ;)

Reserved.

Wow, thanks! Tagged

Installed and tested on 4.2.2 and it works perfectly. I can see this being very useful for troubleshooting member problems when they come up.

Excellent idea. :up:

Installed.

Thank you for the hard work you do to bring us such excellent MODS.

I like the approach here - only thing keeping me from installing is that I know with previous 'Log In as User' mods, it's very easy to forget you are logged in and accidentally post under that user's name. The mods I've used previously would put some kind of a banner warning on all pages when logged in as that user as a reminder. Just a thought, otherwise I like it :)

Understand the concern but that banner is one of the main reasons I made this mod- it needs to be an exact login as a user to troubleshoot- anything different would defeat the purpose.

You do need to be careful but if you're only using it for serious trouble-shooting it shouldn't be a problem- I open the user's account in a completely separate browser and close it as soon as I'm done.

There is another situation that this can be used in that no one has mentioned yet. It is extremely useful for generating a one time only password for members who have lost their password and have requested a reset. You can generate a new password for the user and forward it with instructions that they can only use it once and must change their password at login.

Well for that they should be using the Forgot Password link, that is the most secure way.

That would not work. Once the user has logged in the password would immediately change back to the old "forgotten" password- and the user needs to enter the current password to change the password- the user wouldn't know the current password because by the time they can enter it, it is already the old (non-temporary) value.

In the Admin CP drop down box on the user's page is an "Email Password Reminder" to user that lets the user reset their password, that should be used in the situation you describe.

Very true! Shows that I'm more accustomed to being the moderator of a board than just a member! LOL

Do you have a static IP or a dynamic IP?

I have this one https://vborg.vbsupport.ru/showthread.php?t=233350 on the testing site but I am now looking at temp passwords as a replacement..
Not that the other has failed in any way but BOP5 is always waiting in support and he does make exceedingly good cakes...

Yeah I think the way Joe has done this will make it more accurate in detecting issues a user may be experiencing.

In cases like this, I just enter new password in password field already there, save it (which makes them valid for all), send user new password and tell them to change it asap.

Of course, I prefer that they reset their passwords regularly, but there are rare cases when I do it this way. Don't ask, not all of my users are tech savvy.

Sorry, a bit stuck here...

Where in ACP are user settings?

Do I need to be logged on as Super Administrator to see it?

Am I being thick?

There is some confusion here, at least for myself?

There is no settings per say, to set a password for a user? You do it from the members profile in the ACP.

Logged in as admin not super admin... Can't see the

I am guessing it is enabled by default as I can't see any trace of it in ACP>Options.

EDIT: Ok, skip that... I have just noticed..

Ahhh ok thought you would have seen that. :)

FYI the user settings page I mean is-

Admin CP -> Users (from side menu) -> Search for User - the page that comes up when you find a specific user.

Only super admins will see the temp password box. By default the only super-admin is userid #1 but this can be changed in the config.php file.

Just a quick note, this mod is up for MOTM, if you like it, vote for it, or any of the other mods in the poll. :)

https://vborg.vbsupport.ru/showthread.php?t=309039

Thanks Joe, nice work! :)

Installed and works great.

Joe's mod has saved my message board countless times and even saved my father's life!

Another excellent mod by BOP. Installing.

Very useful mod, thanks BOP!

This plugin does not seem to be compatible with this - https://vborg.vbsupport.ru/showthread.php?t=288450

No, unfortunately it will only work with the default VB password hashing.

Edit- it's also not a simple fix as the current hashing is done on MySQL where BCrypt needs to be done in PHP.

No worries, I was just putting it out there for anyone else who might be using BCrypt

Thank you. Works like a charm

Excelente....