Discussion Forums  >  Self Hosted Control Panels

Replies: 4    Views: 145

tb
buzztouch Evangelist
Profile
Posts: 2050
Reg: Nov 03, 2011
Oxford
32,300
01/01/15 07:18 PM (9 years ago)

Usernames for Self Hosted?

Any chance for usernames in the Self-Hosted platform. I'm thinking sort of like Wordpress, where you can have a username to login to the panel. At the moment, I only want the username at the login. The username could even just be the person's name, instead of email. I know why I want to do this. I have thought it through. I just want to use a username instead of email. The reason is because I am going to giving dozens of new users to my panel soon and I want the login to be neater and not reveal the email address used.
 
bigPaul
Lost but trying
Profile
Posts: 103
Reg: Mar 08, 2013
Darwin
4,530
like
01/01/15 11:41 PM (9 years ago)
Hey Thomas, I don't have access to my SHCP & server at the moment to check but offer the following based on an assumption! I suspect that when you add users in the SHCP they are stored in a MySQL user table on your server, not the BT server. When they login any required API calls to BT are logged on your member account as you are the service provider. If so, then it should be relatively 'simple' to modify the SHCP for your needs. First you would need to add a username field in the user table. Then modify the 'add new user' php to include entry and storage of the extra field. Then modify the login php to provide a choice of email or username login. Lastly modify any other pages that usually display the email to display whichever the 'logged' in value is. Unfortunately I don't have much free time over the next few weeks, hopefully someone might be able to do something sooner for you.
 
Dusko
Veteran developer
Profile
Posts: 998
Reg: Oct 13, 2012
Beograd
22,680
like
01/02/15 01:02 AM (9 years ago)
>relatively 'simple' to modify In general, yes, simple to explain, but the devil is in the details, as usual. >First you would need to add a username field in the user table. Add it through the phpMyAdmin or equivalent, or straight mySQL. This step is easy. >Then modify the 'add new user' php to include entry and storage of the extra field. And add additional layers of protection against malevolent attacks, such as SQL injections, XSS attacks and the like. This if of paramount importance, because, if an attack succeeds, it is your server and your users' data that will be hacked. >Then modify the login php to provide a choice of email or username login. And add some logic to cover cases when there is an email but there isn't the login in the database, and vice versa. Send different emails to the user to let them know where are they in the process, also, design the corresponding pages somewhere on the site to tell them the same thing through the site. >Lastly modify any other pages that usually display the email to display whichever the 'logged' in value is. And then be careful when David Book rolls out a new version of control panel not to overstep over something that he has changed but you didn't. ========== If this is too much of a trouble, you can ask your new users to open email accounts just for this purpose, or, since you can host everything, open the addresses for them on your own server, as a part of the entire package.
 
tb
buzztouch Evangelist
Profile
Posts: 2050
Reg: Nov 03, 2011
Oxford
32,300
like
01/02/15 06:50 AM (9 years ago)
Thanks guys. I did know that some PHP editing was going to be in there, but I didn't think about the SQL. And as said, I would need to keep a detailed change log of what I did. It seems like a bit of an effort, so I might just create a set of emails from my domain. Or I could just take the validation off the email entries.
 
bigPaul
Lost but trying
Profile
Posts: 103
Reg: Mar 08, 2013
Darwin
4,530
like
01/05/15 12:19 AM (9 years ago)
Thomas, having had a quick browse through the SHCP files, it would be much simpler than I thought! The only file that needs to be amended is the login procedure. Currently in the Login process, you will see when it asks for Login Id there is a prompt that says 'usually your email address'. In the login php it checks for a valid email address input and automatically uses the email field in the database search. A small snippet of code could be inserted to check the name fields instead if a valid email is not entered. Hence, they could just enter their name! Or, if you did add a new field in the user table for a username, that field could be selected. It appears that the email address is only displayed during the login process anyway so no need to change any other pages. When you add users to control panel, if you add them as 'normal' they cannot see or access any other users data anyway so no security issues there. Whilst I am no security expert, I dont know if there is any difference between entering an email address as opposed to a standard alphanumeric string into an input field! The login code appears to be a fairly standard login process and suspect the same code is used on the BT server! The only difference though is that we log into a secure server on BT, so if you are worried about security issues raised by Dusko, ensure you are using a secure server.
 

Login + Screen Name Required to Post

pointerLogin to participate so you can start earning points. Once you're logged in (and have a screen name entered in your profile), you can subscribe to topics, follow users, and start learning how to make apps like the pros.