I recently started using with Rules, and mistakenly used a token for acting user login link (which would be an Admin login for most of my Rules).

I think I corrected it prior to it being used, but it would increase safety to disable login links for specific roles.

Is this possible? Thank you.

CommentFileSizeAuthor
#3 login_one_time_role_permission_1082046-3.patch10.95 KBdanielb
#2 login_one_time_role_permission_1082046-2.patch10.54 KBdanielb

Comments

danielb’s picture

danielb commented
Status: Active » Postponed

It's a good idea but I don't have time to develop this at the moment. Patches welcome.

danielb’s picture

danielb commented
Status: Postponed » Active
StatusFileSize
new login_one_time_role_permission_1082046-2.patch10.54 KB

Felt a bit motivated and made a quick patch for D7, because that's the branch I was working in.
Will need to backport and test, etc..

danielb’s picture

danielb commented
StatusFileSize
new login_one_time_role_permission_1082046-3.patch10.95 KB

^ I notice I forgot to take the $form_id param out of login_one_time_form_user_admin_settings_alter() in that patch.

Here is a D6 patch, untested

danielb’s picture

danielb commented

I've committed these patches to git and they'll appear in a dev release.

danielb’s picture

danielb commented
Status: Active » Fixed

I've had a quick go at it, haven't found any problems so far. I'll leave it in the dev release in case anyone has anything else to say about it. But these will be included in future releases.

itserich’s picture

itserich commented

Hello danielb

Thank you. I can't tell for certain where this is configured. I don't see an option under User Management - Login one time.

Under User Managmenet - Permission - there is "use link to login one time".

Several roles are already populated, I can't recall if this was set with the prior version.

If this is how it is configured, does it only allow links to be sent out to people, where each role belonging to a user is allowed to use it? For instance, an Admin may also have the Authenticated role.

Thank you.

danielb’s picture

danielb commented

Yes that's it. A user must have a user role with the "use link to login one time" to be able to get the email sent to them, and also to use the link (in case the permission was removed after the email sent out).
The module automatically gives the permission to all roles when you install or upgrade to this version to keep behaviour consistent with previous versions by default.

itserich’s picture

itserich commented

Hello -

Thanks, I tried it and think it works as designed.

When a user has multiple roles, if one of the roles is enabled the link works. When none of the roles are enabled, there is an error message.

My main concern is not allowing anyone to log in with the link for the user of Admin role. It seems like it would be easier to administer to disable the login link for any user with a checked Role. One example why is every user receives the Authenticated role by Drupal default, I think, so the only way to disable the link with the current permission system for any user is to disable it for Authenticated Roles.

Though, alternatively, it would not be too hard to assign every user a role such as Login One Time so that everyone but Admin could use it, but it would mean every current user has to be assigned a new role to make it work.

One other thing, when the module is enabled, only some of the roles were enabled, not all. I think it might be only for those roles which already have been sent a one time link, but not sure.

Thanks.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.