Hi everyone,
I’m using the **Phone Number Login** plugin (email field accepts phone number and logs in successfully).
However, Osclass core password recovery only accepts a valid email, so entering a phone number on the **Forgot Password** page fails because Osclass checks:
Goal: make **Forgot Password** accept **Email OR Phone Number**, without editing Osclass core files.
Below are the 3 changes I made (plugin + theme) to achieve this.
---
## 1) Plugin backend change: `phone_login/functions.php`
**File:** `oc-content/plugins/phone_login/functions.php`
**What/Why:** Before Osclass processes `page=login&action=recover_post`, convert a phone input into the account’s real email using the plugin model (`ModelPHL::findUser`). This bypasses the core `osc_validate_email()` block safely.
**Added at the bottom of functions.php:**
// ========== PASSWORD RECOVERY: ALLOW PHONE INSTEAD OF EMAIL ==========
function phl_recover_allow_phone() {
if(phl_param('enable') != 1) { return; }
if(Params::getParam('page') == 'login' && Params::getParam('action') == 'recover_post') {
$input = trim(Params::getParam('s_email') ?: Params::getParam('email'));
if($input == '') { return; }
// Email değilse → telefon olarak ara
if(!osc_validate_email($input)) {
$user = ModelPHL::newInstance()->findUser($input, PHL_PHONE_CHECK_ADVANCED);
if($user && !empty($user['s_email']) && osc_validate_email($user['s_email'])) {
Params::setParam('s_email', $user['s_email']);
Params::setParam('email', $user['s_email']);
}
}
}
}
osc_add_hook('init', 'phl_recover_allow_phone', 1);
```
Result: If a user enters a phone number, `s_email` is replaced with the correct email *before* Osclass core validates it.
---
## 2) Plugin frontend change: `phone_login/js/user.js`
**File:** `oc-content/plugins/phone_login/js/user.js`
**What/Why:** Many themes + `UserForm::js_validation()` force email validation, so phone numbers get blocked on the client side (HTML5 `type=email`, patterns, or jQuery Validate email rule).
We patch both **login_post** and **recover_post** forms so the same “Email / Phone” behavior exists on Forgot Password.
**Replaced user.js with:**
$(document).ready(function() {
if(typeof phlIsLogin !== 'undefined' && typeof phlEnable !== 'undefined') {
if(phlIsLogin == 1 && phlEnable == 1) {
function patchForms() {
$('form').each(function() {
var page = $(this).find('input[name="page"]').val();
var action = $(this).find('input[name="action"]').val();
// Login + Recover
if(page === 'login' && (action === 'login_post' || action === 'recover_post' || action === 'forgot_post')) {
// Label
$(this).find('label[for="email"], label[for="s_email"]').text(phlEmailLabel);
// Inputs: email + s_email
$(this).find('input[name="email"], input[name="s_email"]').each(function() {
$(this).prop('type', 'text'); // remove HTML5 email restriction
$(this).removeAttr('pattern'); // remove theme patterns
$(this).attr('placeholder', phlEmailLabel);
});
// Remove jQuery Validate email rule (critical for Recover page)
if (typeof $.validator !== 'undefined') {
var v = $(this).data('validator');
if (v && v.settings && v.settings.rules) {
if (v.settings.rules.s_email && v.settings.rules.s_email.email) {
delete v.settings.rules.s_email.email;
}
if (v.settings.rules.email && v.settings.rules.email.email) {
delete v.settings.rules.email.email;
}
}
}
}
});
}
// run more than once in case theme JS overrides inputs after load
patchForms();
setTimeout(patchForms, 300);
setTimeout(patchForms, 800);
}
}
});
Result: The Forgot Password input accepts phone numbers and the label/placeholder can show “Email / Phone”.
---
## 3) Theme change: remove forced email input in `user-recover.php`
**File:** `oc-content/themes/<your_theme>/user-recover.php`
**What/Why:** My theme (Delta) had a script at the bottom that forces the field to `type="email"`, which breaks phone entry even if the plugin tries to patch it.
**Removed this script block:**
<script type="text/javascript">
$(document).ready(function(){
$('input[name="s_email"]')
.attr('placeholder', 'your.email@dot.com')
.attr('required', true)
.prop('type', 'email');
});
</script>
Result: The plugin controls the input behavior consistently.
---
## Final result
Users can now use **either email or a registered phone number** on the **Forgot Password** page, and Osclass continues the normal recovery flow (email-based recovery, plus any SMS features if you have them integrated separately).
---
## Security note (important)
If your database allows the same phone number on multiple accounts, you should consider blocking phone-based recovery/login in that case (to avoid sending recovery emails for the “wrong” account).
Hope this helps others using Phone Number Login plugin with Osclass!