Jack's Jots

I received a request for clarification on my Joomla Super Administrator Password Recovery Solution.

Hi Jack,

I have a website that was hacked the other day. My hosting
company restored the site however, I can no longer login to the admin section.
The username and password no longer work. I tripped over your posting
http://community.contractwebdevelopment.com/joomla-how-to-reset-super-admin-pass
wordand was wondering if this fix works with the Joomla 1.0 version. If so,
would you mind explaning which file needs to be edited. I am not a wizard at this
stuff and have looked extensively for a simple solution, including the Joomla
forums to no avail.

Thanks for your time. XXXX

There are at least two ways to recover your lost password.

1. The passwords are kept in your mysql database whose location and credentials are held in the configuration.php file at the top of your Joomla directory. You need to update by an SQL query (or table manger), the hashed password to something that you know. It's not too hard, but I had trouble getting my hash right when I tried using mysql admin. Also, it is a bit dangerous to mess with SQL if you don't know what you are doing.
   
   
2. The method that I use is fairly simple but also leaves room for problems:
   
   
   1. Ftp the file plugins\authentication\joomla.php from your site to your machine.
   2. Save a copy of the file (like orig-joomla.php)
   3. Then, modify the line below as shown using wordpad (etc.)
      

      if ($crypt == $testcrypt)

      
      

      to read

      if (true /* $crypt == $testcrypt */)

      
      

      
      

      This enables all logins -- rather dangerous.

   4. Login as admin to the administration site with any password.
   5. On the site, go to user administration and update with a new password.
   6. VERY IMPORTANT: FTP the original file (e.g. orig- joomla.php to joomla.php) back to the server to put back on authentication.

If your account was hacked into, I would also suggest that you also consider changing the config.php file to have new secrets in it. It contains the password of your database (you can also do this in global configurations). You would need to use the mysql tool to make sure that you have matching passwords.

Let me know if this helps.