Hello again moodle universe,
In the place we are using moodle we are wondering if there is a way or maybe an option where we can force all the users that are already in our moodle (1.9) to change their passwords.
i know you can go one by one and check the box to force the user to change the password, but we have over 1000 students and it would be great if we can do this to all the students at the same time.
Thanks in advance for any support.
Fabio.
Hello Fabio,
See here:
http://docs.moodle.org/27/en/Bulk_user_actions
"Force users to change their passwords."
http://docs.moodle.org/27/en/Upload_users#Fields_that_can_be_included
"Password field."
--- p.s.
By the way, regarding your previous post about .htaccess, did you check my last answer:
Hi again Guillermo,
About the other topic, im sorry i missed, thanks for the good orientation you gave me there, i will totally have it in mind.
About the bulk user action to force a password change, in my moodle (1.9.2) its not showing in the drop down menu actions.
Who can it be fixed?
I added an screenshot of my moodle, sorry it is on spanish tho...
Fabio,
Sorry, I missed the 1.9 in your first post. Now that you mention 1.9.2, well, that's quite an old version!
http://docs.moodle.org/19/en/Bulk_user_actions
"Force users to change their passwords (in 1.9.7 onwards)."
Assuming you can access the database directly, I think the following should work: create a test user (within Moodle) and then update the mdl_user.password field to "changeme" or to the MD5 of that string.
UPDATE mdl_user SET password = 'changeme' WHERE username = 'test'
or maybe:
UPDATE mdl_user
SET password = MD5('changeme')
WHERE username = 'test'
Try to login with that user. If that works, then you only need to update the other required records.
Yes, i was worried about that, that is our oldest moodle and we had some security issues last week and we want to change our passwords.
I did some research and i found that in the moodle 1.9.7 you have a php file called user_bulk_forcepasswordchange (thats the file that does the password thing) inside moodle/admin/user, do you think that if i upload that file into the moodle/admin/user of the 1.9.2 moodle it will work?
I'd say that that would depend on the schema structure. You would need to compare the structure of the 1.9.2 one with that of the 1.9.7.
Will this work? (see the image)
Thats from the database and a test user i created, if i put changeme instead of 71b3b26aaa319e0cdf6fdb8429c112b0 will it do what you are suggesting?
Hi again Guillermo,
I did a test with changeme (4cb9c8a8048fd02294477fcb1a41191a) and it worked. Now i have a doubt, where do i find the table where it says that changeme is the word that forces the change of the password? for example, if i want to change the word changeme to 12345678 for example...
Or even better, isnt there a table where i can toggle 1 or 0 the option to force users to change passwords? to all the users?
Hi Fabio,
Did it work with the plain text string or with the MD5 string?
The "changeme" word is hardcoded in many of the Moodle scripts.
I don't know about the 1.9.2 database, but in 2.5 there is a table mdl_user_preferences in which the columns name and value are set as shown when the force password checkbox is selected (at the user profile page):
mdl_user_preferences.name=auth_forcepasswordchange
mdl_user_preferences.value=1
I did not tried with the plain text, i converted it to md5.
I will check that table and the colums to see if i have it on my 1.9.
Will get back to you.
Hi Fabio,
Now that you verified it worked, wouldn't it be best just to update the password column of the mdl_user table?
Anyway, you could run the following two SQL statements.
This one creates a new record for each user at the mdl_user table:
INSERT INTO mdl_user_preferences (userid) SELECT id FROM mdl_user;
And this one updates each record with the required values:
UPDATE mdl_user_preferences
SET name = 'auth_forcepasswordchange',
value = '1'
WHERE name = ''
AND value = '';
Hello Guillermo,
Again thanks for all the help.
I know if i update the password of all the users to changeme it will make them to change the password, but the temporal password now will be changeme, what i want to know is this, is there any way that when they enter again, with their current password, the password change page will prompt?, i mean there has to be a way in the DB, we want the process to be invisible for the participants, you know how it is.
We just checked the total of students and we have 11042...you can imagine the side effects of this.