3

Our MediaWIki 1.25 server was running without $wgSecureLogin. The installer did not copy the setting from DefaultLogin.php, and the setting was not secure by default. (Related WikiMedia bug T111135: LocalSettings.php lacks wgSecureLogin, wgCookieHttpOnly and wgCookieSecure).

We need to have all users reset their passwords. MediaWiki.org has documentation on resetting a password if you know the user's name at Resetting passwords. However, it appears to lack a "force all users to reset their password" setting or method.

Though I have root access to the server, I don't know the MySQL admin password. I hope there's a web based setting or PHP script that can be used to require all accounts to perform the reset.

How do I require a password change for all users?

|improve this question
  • The MySql user and password should be within the MediaWiki configuration files or a script somewhere. I know nothing about MediaWiki, but it would need the user account information to gain access. – closetnoc Sep 7 '15 at 2:19
2

You can force a password change by running

UPDATE user SET user_password_expires = '19990101000000';

(This is not the same as a password reset as it will accept the old password one time. Less secure, more forgiving.)

If you cannot be bothered to look up the DB password, you can just use maintenance/sql.php.

|improve this answer
  • Thanks. Before we get into SQL command line, is there a high level script I can use to do it? It seems like it should be pretty popular since the settings are insecure by default, and a lot of folks should be in the same boat. – jww Sep 9 '15 at 8:00
  • There isn't; why write a high-level script for a low-level operation? If you want to write one, it would be fairly simple (you can look at wrapOldPasswords.php for inspiration) although not nearly as simple as a one-liner in SQL. – Tgr Sep 9 '15 at 21:16
1

Can you perform a query?

UPDATE the_table SET password='UserNeedsToResetPassword';

Now all users' passwords dont work anymore. I choose plain text, because I cant think of a way that sha1($_POST['pass']) results in this ;) (or whatever hash you use)

|improve this answer
  • You can just set it to an empty string which is how MediaWiki represents passwords internally. The drawback of that solution is that you lock out users who don't have a valid email address. – Tgr Sep 8 '15 at 7:40
  • "Can you perform a query?..." - well, I don't really have the access needed at the moment. Plus, I'm not a SQL guy, so I try to avoid SQL altogether. Hence the reason I am looking for the PHP or script to run to do it. – jww Sep 9 '15 at 7:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.