"Password Reminder" is not actually doing anything.

[shefik]

In the Users module. it looks like the setting "Password Reminder" is not actually doing anything. Even if you set the field to mandatory or not mandatory, there is no functionality that uses the module var.

[craigh]

@shefik can this ticket be closed?

[shefik]

This ticket needs to be re-opened. Although I had previously committed code to disable the Password Reminder, all I did was disable/remove the front-end components that display "Password Reminder". So, the issue still exists where the Password Reminder is not functional and it's not doing anything, if you enable the Password Reminder option in the admin.

[cmfcmf]

Ahhh, I now understand what @shefik means: There is no way for the user to receive his password reminder if he looses his password, right? There is no facility saying: Give me your email address / username and I will display your password reminder. So, as @shefik says, the password reminder is completely useless ATM, if I'm not mistaken.

[shefik]

Exactly. Completely useless right now, until we find some use for it.

[craigh]

in most OS, a user is allowed three tries and then the reminder is displayed. perhaps this could be done with JS

[Guite]

The password reminder is used in the welcome email (in some cases where no password is given).

We could add more functionality on the password forgotten page (if the reminder is either set to mandatory or is actually existing). This would be a new feature though.

[craigh]

Honestly, I had no idea what this ticket was about. I've never used this feature.

but I don't know how to make this useful. When a user loses their password, it is regenerated and they have to create a new one, so sending them a reminder isn't helpful.

If we were to try to show it to the user as they login, we would have to probably count the failed logins and on a specified number (3?) show the reminder to the user IF the username is valid. But I think this might not be so secure and allow brute force logins.

I'm wondering if we should just remove the functionality altogether? Was is used in 1.3?