Require Password Change On Login allows admins to force ether all, a selected group or a selected user to change their password.
5.) Forums get hacked, someone steals a copy of the database and you want to do the right thing by asking everyone to change theor password. While it is rather hard to crack the password as it not in plain text, you just (as a admin) want to do the right thing.1.) You admin a 100% closed site wherein registrations are done entirely through the ACP and the initial password is chosen by the admin (what I have right now). You tell your users to change their password on first login. You even provide them a link to use as their "first login" which conveniently points right at the password change screen. But users, being users, ignore you. Months down the line you login to their account with the old password and PM them from their own account a friendly reminder all the while cursing because you wish the above feature was implemented. Damn users.
2.) You suspect a particular users' account may be compromised however you don't want to outright change their pwd & envoke support requests. Instead you want him to have to change it on next login. If it's compromised the un-auth'd user will either abandon the account or change the password. Option a.) yay.; b.) the auth'd user will envoke powers of 'forgot my password' have the temp sent to them, go and reset it and... yay.
3.) You admin a site where, for whatever reason, you are changing a user's password for them (perhaps the knob posted his password online) so you change it and provide it to him, however you want to make sure that they immediately change it once they get back in.
4.) I'm sure there's other use-cases that I can't think of so instead I'll simply say: there's got to be a reason why so many systems (bb and otherwise) come with the 'change password on next login' feature.
An option in the ACP that let admins click on to require all users to change their password. To make sure that it doesn't get clicked on by mistake, the admin would be asked if they are sure if they want to do this. There should also be an option that let admins force password change for a user or menbers in a certan group.
I think this is overkill but maybe allow only the founder to do this?
I hope I got everything covered. If not, please let me know.Logic flow:
-Administrator checks "Require new password" in ACP for one or all users
-User logs in using old password, immediately redirected to new screen with two fields ("New password"/"Confirm new password") and an explanation (something to the effect of "Administrator has required you to set a new password. The new password cannot be the same as the old password." as well as any password strength requirements if we implement that).
-User enters password
----Same as old password, error; require new password
----Different from old password, does not meet password strength requirements, error; require new password
----Different from old password, meets strength requirements, success; continue to original destination
-User attempts to view another page before changing password; redirect back to password change screen