Pages

Monday, June 9, 2014

Reset admin password in drupal 7

The password reset method described below uses a PHP script that must be uploaded to the web server to reset the administrator password. The ability to upload a PHP file to the server where the site is hosted is required for successful execution of this method.

Under the hood, the PHP script executes a full Drupal bootstrap in order to obtain access to the necessary functions that generate the administrative password and then update the database with the new password that you specify via the URL when you execute the script through the web browser.

Note: leaving this password reset script on your server after resetting the password constitutes a highly critical security hole that enables anyone to reset your administrator password. Use this script carefully, and always delete the script after you're finished using it.

  1. First, create a file with a random name (gh34tu9.php for example)
  2. Copy and paste the following contents into the file, and save the file
  3. 
    <!--php
    define('DRUPAL_ROOT', getcwd());
    require_once DRUPAL_ROOT . '/includes/bootstrap.inc';
    drupal_bootstrap(DRUPAL_BOOTSTRAP_FULL);
    require_once DRUPAL_ROOT . '/includes/password.inc';
    if (isset($_GET['pass']) && !empty($_GET['pass'])) {
      $newhash =  user_hash_password($_GET['pass']);
    }
    else {
      die('Retry with ?pass=PASSWORD set in the URL');
    }
    $updatepass = db_update('users')
      --->fields(array(
        'pass' => $newhash,
    // Uncomment the following lines to reset the administrative username and/or email address, if necessary.
    //    'name' => 'admin',
    //    'mail' => 'yourmail@example.com'
      ))
      ->condition('uid', '1', '=')
      ->execute();
    print "Done. Please delete this file immediately!";
    drupal_exit();
    ?>
    
  4. Upload the file to the root of the Drupal installation directory (i.e., where index.php, update.php, robots.txt and other files and directories exist)
  5. Execute the script, by requesting the file in a web browser using the following URL pattern:
  6. 
    http://example.com/gh34tu9.php?pass=mypassword
    
  7. In the above URL,
    - replace example.com with your actual domain name,
    - replace gh34tu9.php with the actual file name that you specified in step one above,
    - replace mypassword with the desired new password.
If the script executes successfully, you will see the text "Done" in your web browser. The password of the administrative account created when installing Drupal (i.e., user/1) will be changed to "mypassword" (or whatever value you specify).
Finally, delete the file from the Drupal installation root directory.

Ref: https://drupal.org/node/1556488