====== Security QA for Forgotten Password ======

Have you ever noticed that some websites require you to supply them with a security question and answer for your account? If you forget your password, you are required to provide those credentials in order to retrieve a new password. This protects customer information and ensures that the original creator of the account will always have a way of getting their account back (if their account had been hacked/stolen).

In this tutorial, I'm going to explain how to add those two fields to the registration page and require them to be provided on the forgot password page - where they the information will be validated.

Please open the following files, as we will be working with them:
**/app/code/core/Mage/Customer/controllers/AccountController.php** - This controls all of the functions that we need to edit.
**/app/design/frontend/default/yourtheme/template/forgotpassword.phtml** - This is the template file for the forgot password page.
**/app/design/frontend/default/yourtheme/template/customer/form/register.phtml** - this is the template file for the register page.

Alright, first things first. We will start by adding the Security Question and Answer fields to the registration page. We will also have to create a new attribute for the two fields.

At the top of register.phtml, add the following code:
<code php>
<?php
$setup = new Mage_Eav_Model_Entity_Setup('core_setup');
// Set up the Security Question Attribute
$AttrCode = 'squestion';
$settings = array (
    'position' => 1,
    'is_required'=> 1
);
// Set up the Security Answer Attribute
$AttrCode2 = 'sanswer';
$settings2 = array (
    'position' => 1,
    'is_required'=> 1
);
// Adds both attributes
$setup->addAttribute('1', $AttrCode, $settings);
$setup->addAttribute('1', $AttrCode2, $settings2);
?>
</code>
Now, navigate your browser to  http://www.yoursite.com/customer/account/create/
By navigating to this page, you have executed the php code we just added to the register.phtml file. Your attributes are now added. Please remove or comment out the code we previously added to the register.phtml file (it is no longer needed).

In register.phtml, navigate near Line 58. You should see this line of code:
<code php>
        </ul>
</code>
Immediately after this line, add the following block of code:
<code php>
<br/><br/>Please type in your security question/answer for retrieving your password.<br/>
    <ul>
        <li>
                <div class="input-box">
                    <label for="squestion"><?php echo $this->__('Security Question') ?> <span class="required">*</span></label><br />
                    <select id="squestion" name="squestion" title="<?php echo $this->__('Security Question') ?>" class="required-entry validate-select">
            <option value="What is the name of your dog?">What is the name of your dog?</option>
                        <option value="What is the name of your favorite teacher?">What is the name of your favorite teacher?</option>
            <option value="What is your maiden name?">What is your maiden name?</option>
            <option value="In what city were you born?">In what city were you born?</option>
            <option value="What is your favorite food?">What is your favorite food?</option>
                    </select>
                </div>
                <div class="input-box">
                    <label for="sanswer"><?php echo $this->__('Security Answer') ?> <span class="required">*</span></label><br />
                    <input type="text" name="sanswer" id="sanswer" value="<?php echo $this->htmlEscape($this->getFormData()->getSecurityAnswer()) ?>" title="<?php echo $this->__('Security Answer') ?>" class="required-entry input-text" />
                </div>
            </li>
        </ul>
</code>
Now, in your forgotpassword.phtml file, find this block of code (around line 25):
<code php>
<fieldset>
                <legend><?php echo $this->__('Retrieve your password here') ?></legend>
        <p><?php echo $this->__('Please enter your email below and we will send you a new password.') ?></p>
        <ul class="form-list">
            <li>
                <div class="input-box"><label for="email_address"><?php echo $this->__('Email Address') ?> <span class="required">*</span></label><br/>
                <input name="email" alt="email" type="text" id="email_address" class="required-entry validate-email input-text" value="<?php echo $this->htmlEscape($this->getEmailValue()) ?>" /></div></li>
        </ul>
    <div class="button-set">
        <p class="required"><?php echo $this->__('* Required Fields') ?></p>
        <a href="<?php echo $this->helper('customer')->getLoginUrl() ?>" class="left">&laquo; <?php echo $this->__('Back to Login') ?></a>
        <button type="submit" class="form-button right"><span><?php echo $this->__('Submit') ?></span></button>
    </div>
        </fieldset>
</code>

Replace this block of code with this:
<code php>
<fieldset>
                <legend><?php echo $this->__('Retrieve your password here') ?></legend>
        <p><?php echo $this->__('Please enter your email below and we will send you a new password.') ?></p>
        <ul class="form-list">
            <li>
                <div class="input-box"><label for="email_address"><?php echo $this->__('Email Address') ?> <span class="required">*</span></label><br/>
                <input name="email" alt="email" type="text" id="email_address" class="required-entry validate-email input-text" value="<?php echo $this->htmlEscape($this->getEmailValue()) ?>" /></div>
        </li>
        <li>
        <div class="input-box">
        <?
        if(strlen($this->htmlEscape($this->getSquestionValue()))>0){
        ?>
        <label for="squestion"><?php echo $this->__('Security Question') ?> <span class="required">*</span></label><br />
        <input name="squestion" alt="squestion" type="text" id="squestion" class="required-entry input-text" style="border:0; background:none; font-weight:bold;" value="<?php echo $this->htmlEscape($this->getSquestionValue()) ?>" readonly /></div>
                <? } else { ?>
        <label for="squestion"><?php echo $this->__('Security Question') ?> <span class="required">*</span></label><br />
                    <select id="squestion" name="squestion" title="<?php echo $this->__('Security Question') ?>" class="required-entry validate-select">
            <option value="What is the name of your dog?">What is the name of your dog?</option>
                        <option value="What is the name of your favorite teacher?">What is the name of your favorite teacher?</option>
            <option value="What is your maiden name?">What is your maiden name?</option>
            <option value="In what city were you born?">In what city were you born?</option>
            <option value="What is your favorite food?">What is your favorite food?</option>
                    </select>
        </div>
        <? } ?>
        </li>
        <li>
        <div class="input-box">
        <label for="sanswer"><?php echo $this->__('Security Answer') ?> <span class="required">*</span></label><br />
        <input name="sanswer" alt="sanswer" type="text" id="sanswer" class="required-entry input-text" /></div>
        </div>
        </li>
        </ul>
    <div class="button-set">
        <p class="required"><?php echo $this->__('* Required Fields') ?></p>
        <a href="<?php echo $this->helper('customer')->getLoginUrl() ?>" class="left">&laquo; <?php echo $this->__('Back to Login') ?></a>
        <button type="submit" class="form-button right"><span><?php echo $this->__('Submit') ?></span></button>
    </div>
        </fieldset>
</code>
Alright, your template files are finished. Now we need to edit the AccountController.php code.
Find this block of code:
<code php>
public function loginAction()
    {
        if ($this->_getSession()->isLoggedIn()) {
            $this->_redirect('*/*/');
            return;
        }
        $this->getResponse()->setHeader('Login-Required', 'true');
        $this->loadLayout();
        $this->_initLayoutMessages('customer/session');
        $this->_initLayoutMessages('catalog/session');
        $this->renderLayout();
    }
</code>
Add this line of code immediately before "$this->getResponse()->setHeader('Login-Required', 'true');"
<code php>
if(!$this->_getSession()->getUsername()){$this->_getSession()->unsForgottenEmail();}
</code>
Now, find this block of code within the **loginPostAction** function:
<code php>
if (!$session->login($login['username'], $login['password'])) {
                    $session->addError($this->__('Invalid login or password'));
                    $session->setUsername($login['username']);
                }
</code>
Replace it with this:
<code php>
if (!$session->login($login['username'], $login['password'])) {
                    $session->addError($this->__('Invalid login or password'));
                    $session->setUsername($login['username']);
                    $session->setForgottenEmail($login['username']);
                }
</code>

Now, find this block of code within the **createPostAction** function:
<code php>
$customer = Mage::getModel('customer/customer')
                ->setFirstname($this->getRequest()->getPost('firstname'))
                ->setLastname($this->getRequest()->getPost('lastname'))
                ->setEmail($this->getRequest()->getPost('email'))
                ->setPassword($this->getRequest()->getPost('password'))
                ->setConfirmation($this->getRequest()->getPost('confirmation'))
                ->setId(null);
</code>
Add these lines immediately after the line containing setEmail:
<code php>
->setSquestion($this->getRequest()->getPost('squestion'))
                ->setSanswer($this->getRequest()->getPost('sanswer'))
</code>

Now we need to edit the forgotPasswordAction() function. So find this block of code:
<code php>
public function forgotPasswordAction()
    {
        $this->loadLayout();

        $this->getLayout()->getBlock('forgotPassword')->setEmailValue(
            $this->_getSession()->getForgottenEmail()
        );
        $this->_getSession()->unsForgottenEmail();

        $this->_initLayoutMessages('customer/session');
        $this->renderLayout();
    }
</code>
And replace it with this:
<code php>
public function forgotPasswordAction()
    {
        $this->loadLayout();

        $this->getLayout()->getBlock('forgotPassword')->setEmailValue(
            $this->_getSession()->getForgottenEmail()
        );

        if((strlen($this->_getSession()->getForgottenEmail())>0)){
            $customer = Mage::getModel('customer/customer')
                    ->setWebsiteId(Mage::app()->getStore()->getWebsiteId())
                    ->loadByEmail($this->_getSession()->getForgottenEmail());
            //$this->_getSession()->unsForgottenEmail();
            if ($customer->getId()) {
                $this->getLayout()->getBlock('forgotPassword')->setSquestionValue(
                    $customer->getSquestion()
                );
            } else {
                $this->_getSession()->addError($this->__('This email address was not found in our records'));
            }
        }

        $this->_initLayoutMessages('customer/session');
        $this->renderLayout();
    }
</code>

Alright, finally we can edit the forgotPasswordPostAction() function. Find this large block of code:
<code php>
public function forgotPasswordAction()
    {
        $this->loadLayout();

        $this->getLayout()->getBlock('forgotPassword')->setEmailValue(
            $this->_getSession()->getForgottenEmail()
        );
        $this->_getSession()->unsForgottenEmail();

        $this->_initLayoutMessages('customer/session');
        $this->renderLayout();
    }

    /**
     * Forgot customer password action
     */
    public function forgotPasswordPostAction()
    {
        $email = $this->getRequest()->getPost('email');
        if ($email) {
            if (!Zend_Validate::is($email, 'EmailAddress')) {
                $this->_getSession()->setForgottenEmail($email);
                $this->_getSession()->addError($this->__('Invalid email address'));
                $this->getResponse()->setRedirect(Mage::getUrl('*/*/forgotpassword'));
                return;
            }
            $customer = Mage::getModel('customer/customer')
                ->setWebsiteId(Mage::app()->getStore()->getWebsiteId())
                ->loadByEmail($email);

            if ($customer->getId()) {
                try {
                    $newPassword = $customer->generatePassword();
                    $customer->changePassword($newPassword, false);
                    $customer->sendPasswordReminderEmail();

                    $this->_getSession()->addSuccess($this->__('A new password was sent'));

                    $this->getResponse()->setRedirect(Mage::getUrl('*/*'));
                    return;
                }
                catch (Exception $e){
                    $this->_getSession()->addError($e->getMessage());
                }
            }
            else {
                $this->_getSession()->addError($this->__('This email address was not found in our records'));
                $this->_getSession()->setForgottenEmail($email);
            }
        } else {
            $this->_getSession()->addError($this->__('Please enter your email.'));
            $this->getResponse()->setRedirect(Mage::getUrl('*/*/forgotpassword'));
            return;
        }

        $this->getResponse()->setRedirect(Mage::getUrl('*/*/forgotpassword'));
    }
</code>
And replace it with this:
<code php>
public function forgotPasswordPostAction()
    {
        $email = $this->getRequest()->getPost('email');
        $squestion = $this->getRequest()->getPost('squestion');
        $sanswer = $this->getRequest()->getPost('sanswer');
        if ($email) {
            if (!Zend_Validate::is($email, 'EmailAddress')) {
                $this->_getSession()->setForgottenEmail($email);
                $this->_getSession()->addError($this->__('Invalid email address'));
                $this->getResponse()->setRedirect(Mage::getUrl('*/*/forgotpassword'));
                return;
            }
            $customer = Mage::getModel('customer/customer')
                ->setWebsiteId(Mage::app()->getStore()->getWebsiteId())
                ->loadByEmail($email);

            if ($customer->getId()) {
                if(($customer->getSquestion()==$squestion)&&($customer->getSanswer()==$sanswer)) {
                    try {
                        $newPassword = $customer->generatePassword();
                        $customer->changePassword($newPassword, false);
                        $customer->sendPasswordReminderEmail();

                        $this->_getSession()->addSuccess($this->__('A new password was sent'));

                        $this->getResponse()->setRedirect(Mage::getUrl('*/*'));
                        return;
                    }
                    catch (Exception $e){
                        $this->_getSession()->addError($e->getMessage());
                    }
                } else {
                    $this->_getSession()->addError($this->__('Your security Q&A credentials were incorrect.'));
                    $this->_getSession()->setForgottenEmail($email);
                }
            }
            else {
                $this->_getSession()->addError($this->__('This email address was not found in our records'));
                $this->_getSession()->setForgottenEmail($email);
            }
        } else {
            $this->_getSession()->addError($this->__('Please enter your email.'));
            $this->getResponse()->setRedirect(Mage::getUrl('*/*/forgotpassword'));
            return;
        }

        $this->getResponse()->setRedirect(Mage::getUrl('*/*/forgotpassword'));
    }
</code>

Alright, now that it is finished, I'll explain the full functionality. If you navigate to your account login page and the login fails, you will be redirected to the same page telling you that your password/username was incorrect. Now, click on the Forgot Password link that should already be there. You will notice that the username and security question will automatically be filled in for the username you attempted to login to. From here, put in your security answer and your password will be sent to you. If you type in the wrong security answer, you will get a notice saying your security credentials were incorrect.

Let me know if you have any questions or suggestions for improvement!

Thanks,

Chris Woodard