Password recovery

[seadhna]

Hi there,
when "password recovery" is switched on, users can receive a new password by entering their username and email address. Is it possible to remove the need to enter username? i.e. just email address?

[datahell]

Can be done. However, using both is safer. There is always a chance someone else to perform a reset pretending you. Having this in mind is safer to ask for 2 identities than just 1.

[seadhna]

Yes, I understand and agree. But we need to do this on one website. If you could explain how, it would be much appreciated.

[datahell]

It can be done but you need to modify a default component (User) which is not recommended as you will loose your changes after a CMS update. Also by this change you lower Elxis security. So, I will not give you any instructions.

An alternative solution is to develop your own password recovery mechanism in a plugin, or a module, or built-in in your template.

[seadhna]

ok, thanks datahell.