How should a user request a password reset when they do not remember the e-mail address that one of their accounts utilises?

Support Self-hosting
,
1

If a user has located their account (so they know its username and id), but does not know their password (nor have a 1FA authentication method added, like CTAP2), they are unable to acquire the e-mail address of the account by merely appending .json to the relevant profile URI.

Consequently, how are they to request a password reset, considering that the password reset form requires an e-mail address; it does not accept a username?

2

they can search their various email accounts for the forum domain? how many email addresses do they have? :laughing:

If all else fails…

  • send the admin a list of possible email addresses to verify (the admin could send an email to the correct one, which would be fairly secure)
  • ask the admin if they’re willing to send an obscured version like a**********t@*****.com? sometimes that’s enough to help (but also does leak a little info, so they might not)
3

Staff users can see a user’s email address that they registered with. The staff can tell the user what their email is, so that the user can log in.

Email cannot be viewed in the JSON. In fact, it’s quite hidden, even for staff (i.e. behind the ‘Show’ button), and is logged IIRC into staff logs.

Is that possible?