Admin Password Change Alert Message Display -- Support Thread

[lat9]

Now that 1.5.0 is available, your admin users might have noticed that their password must be changed within 90 days but there's no way for them to tell when they last changed it!

This small add-on displays the currently signed-on admin's "last password change date" within the header of the admin page. Simply copy two files to your shop's admin directory and you're good to go!

The add-on is now available for download: http://www.zen-cart.com/index.php?ma...oducts_id=2064

[lat9]

An updated v1.1.0 is now available from the Free Software Add Ons area. I've updated the display to show, for the currently logged-in admin, the last time his/her password was changed and the date and IP address associated with that admin's previous login.

[adb34]

Very good plug-in. I would like to change the order of date time: At the moment its says '2013-08-06 15:10:49' I would like to change it to something like '08-September-2013 @ 15:10'

Thanks in advance

[lat9]

Look at the block of code added to /YOUR_ADMIN/includes/header.php, starting at line 211:

//-bof-lat9 Display last password change and login
  if (function_exists('zen_get_admin_name') && function_exists('zen_read_user')) {
    $adminInfo = zen_read_user(zen_get_admin_name($_SESSION['admin_id']));
?>
  </tr>
  <tr>
    <td align="right" class="main" valign="top"><?php echo TEXT_PASSWORD_LAST_CHANGE . $adminInfo['pwd_last_change_date']; ?></td>
  </tr>
  <tr>
    <td align="right" class="main" valign="top"><?php echo TEXT_LAST_LOGIN_INFO . $_SESSION['last_login_date'] . ' [' . $_SESSION['last_login_ip'] . ']'; ?></td>
<?php
  }
//-eof-lat9

and change that to

//-bof-lat9 Display last password change and login
  if (function_exists('zen_get_admin_name') && function_exists('zen_read_user')) {
    $adminInfo = zen_read_user(zen_get_admin_name($_SESSION['admin_id']));
?>
  </tr>
  <tr>
    <td align="right" class="main" valign="top"><?php echo TEXT_PASSWORD_LAST_CHANGE . substr($adminInfo['pwd_last_change_date'], 0, 10) . ' @ ' . substr($adminInfo['pwd_last_change_date'], 11, 5); ?></td>
  </tr>
  <tr>
    <td align="right" class="main" valign="top"><?php echo TEXT_LAST_LOGIN_INFO . $_SESSION['last_login_date'] . ' [' . $_SESSION['last_login_ip'] . ']'; ?></td>
<?php
  }
//-eof-lat9

[adb34]

Look at the block of code added to /YOUR_ADMIN/includes/header.php, starting at line 211:

//-bof-lat9 Display last password change and login
  if (function_exists('zen_get_admin_name') && function_exists('zen_read_user')) {
    $adminInfo = zen_read_user(zen_get_admin_name($_SESSION['admin_id']));
?>
  </tr>
  <tr>
    <td align="right" class="main" valign="top"><?php echo TEXT_PASSWORD_LAST_CHANGE . $adminInfo['pwd_last_change_date']; ?></td>
  </tr>
  <tr>
    <td align="right" class="main" valign="top"><?php echo TEXT_LAST_LOGIN_INFO . $_SESSION['last_login_date'] . ' [' . $_SESSION['last_login_ip'] . ']'; ?></td>
<?php
  }
//-eof-lat9

and change that to

//-bof-lat9 Display last password change and login
  if (function_exists('zen_get_admin_name') && function_exists('zen_read_user')) {
    $adminInfo = zen_read_user(zen_get_admin_name($_SESSION['admin_id']));
?>
  </tr>
  <tr>
    <td align="right" class="main" valign="top"><?php echo TEXT_PASSWORD_LAST_CHANGE . substr($adminInfo['pwd_last_change_date'], 0, 10) . ' @ ' . substr($adminInfo['pwd_last_change_date'], 11, 5); ?></td>
  </tr>
  <tr>
    <td align="right" class="main" valign="top"><?php echo TEXT_LAST_LOGIN_INFO . $_SESSION['last_login_date'] . ' [' . $_SESSION['last_login_ip'] . ']'; ?></td>
<?php
  }
//-eof-lat9

Thanks for the code.

The date is still wrong way round.

It is displayed: 2013-08-06
I would like it 06-08-2013 however like 6 August 2013

[lat9]

OK, let's try like this:

//-bof-lat9 Display last password change and login
  if (function_exists('zen_get_admin_name') && function_exists('zen_read_user')) {
    $adminInfo = zen_read_user(zen_get_admin_name($_SESSION['admin_id']));
    $year = substr($adminInfo['pwd_last_change_date'], 0, 4);
    $month = substr($adminInfo['pwd_last_change_date', 5, 2);
    $day = substr($adminInfo['pwd_last_change_date', 8, 2);
    $hour = substr($adminInfo['pwd_last_change_date', 11, 2);
    $minute = substr($adminInfo['pwd_last_change_date', 14, 2);
    $second = substr($adminInfo['pwd_last_change_date, 17, 2);
    $timestamp = mktime($hour, $minute, $second, $month, $day, $year);
?>
  </tr>
  <tr>
    <td align="right" class="main" valign="top"><?php echo TEXT_PASSWORD_LAST_CHANGE . strftime('%d-%B-%Y @ %H:%M', $timestamp); ?></td>
  </tr>
  <tr>
    <td align="right" class="main" valign="top"><?php echo TEXT_LAST_LOGIN_INFO . $_SESSION['last_login_date'] . ' [' . $_SESSION['last_login_ip'] . ']'; ?></td>
<?php
  }
//-eof-lat9

The format I chose for strftime will output something similar to '14-September-2013 @ 12:25'. There are many, many more formatting options available for the strftime function (http://us2.php.net/manual/en/function.strftime.php)!

[DrByte]

Now that 1.5.0 is available, your admin users might have noticed that their password must be changed within 90 days but there's no way for them to tell when they last changed it!

2 Questions:
1. But ... why do they need to know "when they last changed it"?
2. You said "must be changed within 90 days". But, that's not correct. The system will auto-prompt them to set new password after 90 days is up. It won't suddenly "lock them out because they forgot to change it in time".

The sites where I've seen this mod installed make the admin home screen seem like there will be sudden doom if they don't pay careful attention to changing their password "in the nick of time". But that's the wrong concept. Passwords are tough enough to manage without creating alarm and fear of getting locked out because they weren't watching the calendar.

Other than dropping PCI rules altogether, how can the system be changed so that there's no need for this plugin?

[lat9]

2 Questions:
1. But ... why do they need to know "when they last changed it"?
2. You said "must be changed within 90 days". But, that's not correct. The system will auto-prompt them to set new password after 90 days is up. It won't suddenly "lock them out because they forgot to change it in time".

The sites where I've seen this mod installed make the admin home screen seem like there will be sudden doom if they don't pay careful attention to changing their password "in the nick of time". But that's the wrong concept. Passwords are tough enough to manage without creating alarm and fear of getting locked out because they weren't watching the calendar.

Other than dropping PCI rules altogether, how can the system be changed so that there's no need for this plugin?

1) I modeled this plugin after a similar display that one of my banks uses. They, too, have a "change your password every 90 days" requirement and I've found it useful (I log into the account once a week) to "know" that I'm going to need to have a new password ready for next week's login (kind of a heads-up).
2) The wording (and I've not reviewed the plugin's readme ) was based on my initial reading at the introduction of the feature in ZC v1.5.0 (about 3 years ago). When installed, the plugin adds 2 items to the header, indicating the date the password was last changed and the IP address of the last login using their account -- I'm missing the doom and gloom there.

[DrByte]

My point about doom and gloom is partially the wording but also the big bold front-and-center alert that draws the eye to that message as though it's a crucial urgent warning.

In 1.6.0 we've changed the wording of all the password-expiry stuff so that it's better understood by the lay person, who has no concept of what "password expiry" has been about for the past 20 years.

[mc12345678]

I have also seen systems (perhaps only described), regardless of when the password is due to change provide such, last whatever time (login, password change, etc) to allow the individual looking at the information to identify if there was a "human" issue such as someone else logging in or changing the password and then basically changing it back without covering all of their tracks...