Our MediaWIki 1.25 server was running without $wgSecureLogin
. The installer did not copy the setting from DefaultLogin.php
, and the setting was not secure by default. (Related WikiMedia bug T111135: LocalSettings.php lacks wgSecureLogin, wgCookieHttpOnly and wgCookieSecure).
We need to have all users reset their passwords. MediaWiki.org has documentation on resetting a password if you know the user's name at Resetting passwords. However, it appears to lack a "force all users to reset their password" setting or method.
Though I have root access to the server, I don't know the MySQL admin password. I hope there's a web based setting or PHP script that can be used to require all accounts to perform the reset.
How do I require a password change for all users?