How to force users to complete security questions

[hmadadian]

hi

we need to lock user area until they fill and complete the security questions.

how I am gonna do that?

 

[brian!]

if memory serves, after you've added security questions to WHMCS, the security answer becomes a required field when registering / ordering... or are you talking about existing users when the security questions were added to WHMCS after they had already registered ?

[hmadadian]

2 hours ago, brian! said:

if memory serves, after you've added security questions to WHMCS, the security answer becomes a required field when registering / ordering... or are you talking about existing users when the security questions were added to WHMCS after they had already registered ?

the second scenario

we want to force previous users (which did not complete and register before we add security question).

I see a similar article in this community but it is not quite like what I want.

https://whmcs.community/topic/266313-require-security-question-selection-if-empty-amp-notify-client-on-change/

the above topic just suggests and notify the user. I want to restrict user privileges to everything (except "complete the security questions" part) until the user completes it. of course, as I said I want this for users who did not complete security questions yet!

 

[yggdrasil]

I don't think this is possible out of the box. Maybe creating a hook with code that detects if the security questions are blank and force them to that page on each login. Users that completed them already would be bypassed and log in as usual.

[brian!]

20 hours ago, hmadadian said:

the above topic just suggests and notify the user. I want to restrict user privileges to everything (except "complete the security questions" part) until the user completes it. of course, as I said I want this for users who did not complete security questions yet!

you could use a variation of the hook I posted in the thread below...

<?php

# Force Security Questions Hook
# Written by brian!

function force_security_questions_hook($vars) {

	$client = Menu::context('client');
	$securityid = $client->securityQuestionId;
	if ($client && $vars['templatefile'] != "clientareasecurity" && $securityid===0) {
		header("Location: clientarea.php?action=security");
		exit;
	}
}
add_hook("ClientAreaPage", 1, "force_security_questions_hook");

that should redirect any client, who doesn't have a security question set, to the security page as soon as they login... and they shouldn't be able to go to any other page until they set the question & answer. 🙂

I suppose for politeness, and by way of explaining why they ain't going anywhere, you might need to change the "Setting a security question..." text string using a Language Override and tell them that they HAVE to complete it.

$_LANG['registersecurityquestionblurb'] = "Setting a security question will provide extra security, as all changes to your account require providing the additional information from your question.";

I suppose you could combine it with the popup windows I generated in the other thread you linked too and prevent the bootstrap popup from being dismissed - that's certainly doable... but I won't be here for the next few days, so if you want my help with that, it will have to wait until Friday or the weekend. 3️⃣4️⃣5️⃣

[hmadadian]

On 4/29/2019 at 10:03 PM, brian! said:

you could use a variation of the hook I posted in the thread below...

<?php

# Force Security Questions Hook
# Written by brian!

function force_security_questions_hook($vars) {

	$client = Menu::context('client');
	$securityid = $client->securityQuestionId;
	if ($client && $vars['templatefile'] != "clientareasecurity" && $securityid===0) {
		header("Location: clientarea.php?action=security");
		exit;
	}
}
add_hook("ClientAreaPage", 1, "force_security_questions_hook");

that should redirect any client, who doesn't have a security question set, to the security page as soon as they login... and they shouldn't be able to go to any other page until they set the question & answer. 🙂

I suppose for politeness, and by way of explaining why they ain't going anywhere, you might need to change the "Setting a security question..." text string using a Language Override and tell them that they HAVE to complete it.

$_LANG['registersecurityquestionblurb'] = "Setting a security question will provide extra security, as all changes to your account require providing the additional information from your question.";

I suppose you could combine it with the popup windows I generated in the other thread you linked too and prevent the bootstrap popup from being dismissed - that's certainly doable... but I won't be here for the next few days, so if you want my help with that, it will have to wait until Friday or the weekend. 3️⃣4️⃣5️⃣

thank you for your help.

everything is okay but right now what I want is, show some text message (not in a popup or any other shape. just simple text) in the security question area just for users who did not complete the security questions. (this message should not show for other users)

would you please help me with its hook?

[brian!]

On 01/05/2019 at 09:58, hmadadian said:

everything is okay but right now what I want is, show some text message (not in a popup or any other shape. just simple text) in the security question area just for users who did not complete the security questions. (this message should not show for other users)

would you please help me with its hook?

rather than using a hook, it might be easier to just edit the clientareasecurity.tpl, specifically the block below as that checks whether the client has a security answer... and add your text in there... either hardocded or using a Language Override.

        {if !$nocurrent}
        <div class="form-group">
            <label for="inputCurrentAns" class="control-label">{$currentquestion}11</label>
            <input type="password" name="currentsecurityqans" id="inputCurrentAns" class="form-control" autocomplete="off" />
        </div>
        {/if}