SMS password recovery

Question

I'm currently using D7. When my users attempt to request a password reset, 95% of the time, these reset emails land in their spam, or are blocked by whomever their email provider is. That being said, I'm looking to implement a way for my user to regain access to their account by receiving this password reset link via SMS instead.

Currently, my site collects the user's phone number on registration, and I have the Twilio module installed. All of that said, there doesn't seem to be a Drupal Rule that I can execute for "When anonymous user requests password reset".

Ideally, I'd like to have a Drupal rule search my user list for the user that contains the input email, and then simply send the generated password reset link to the phone number on file (also attached to the found User's account).

Is this possible?

Answer 1

You might want to investigate using the SMS Framework module along with Twilio SMS Integration instead - they have more users and there is more active and more recent development with these modules. They also have D8 ports, so you are covered for when you decide to upgrade to D8. But the answer below will work whether you use the above two modules or whether you just use the Twilio module.

When you say "Drupal Rule" I'm going to assume you mean a Rule made with the Rules module.

A Rules module Rule requires an Event, one or more optional Conditions, and one or more Actions. In this case, the Action would be to send an SMS message. The SMS Framework module does provide an Action for Rules, which is named "Send sms". You can use this action to send the SMS message. All you need now is an Event.

You want an Event that is fired when the anonymous user submits the password reset form. Drupal core does not have any hooks or events for password reset. This Event does not come with Rules. I know of no contributed modules that provide this Event. So you will have to write a few dozen lines of code. You can also do this without Rules, but you will also have to write code and it will be more code than with Rules.

Writing an Event is not hard, but it does require coding. A tutorial on how to do that is outside the scope of this issue. Below I will outline the basic steps and point you to some documentation. What you need to do is:

• Implement hook_rules_event_info() to declare your event to Rules and define the variables that will be stored in the event. These variables will probably the telephone number and the user email address plus whatever other information you may need to complete the task.
• Implement hook_form_alter() to alter the user_pass form so that it executes a custom submit handler.
  • Your custom submit handler should use the submitted email address to look up the user's telephone number.
  • Your custom submit handler will then call rules_invoke_event() to invoke your own custom event. You will pass this event the telephone number and the email address.

There are many examples of this that can be found. Some randomly selected pages which discuss this are:

• https://www.drupal.org/docs/7/modules/rules/3-developer-documentation/events
• https://drupalize.me/videos/declaring-events-rules?p=1152
• https://drupalize.me/videos/invoking-rules-events?p=1152
• https://www.powercms.in/article/how-create-custom-rules-event-programmatically-drupal-7
• https://azimut7.com/blog/custom-rules-event-drupal7