Steps to reproduce:

With both Password policy and Password change tab enabled, log out and request a new password via standard method (user/password).

Click link in email, then click "Log in"

You cannot access the "Edit" tab, and get redirected back to the "View" tab, with no way to change your password.

CommentFileSizeAuthor
#9 password_policy-1188264-password_tab_reset-9.patch733 byteserikwebb
#7 password_policy-1188264-password_tab_reset-7.patch731 byteserikwebb
#4 01.Click Password tab.png171.32 KBroball
#4 02.Your password has expired - Redirection to Account tab.png172.35 KBroball

Comments

dppeak’s picture

dppeak commented

Look here for the fix. http://drupal.org/node/1189756.

draenen’s picture

draenen commented
Status: Active » Closed (duplicate)

Patched in http://drupal.org/node/1189756.

yan’s picture

yan commented
Version: 6.x-1.0 » 6.x-1.5
Priority: Normal » Critical
Status: Closed (duplicate) » Active

It seems the patch from #1189756: Changing location of password tab in password_policy_password_tab has broken functionality in password_policy didn't really solve the problem. At least I still can't change the password with Password change tab enabled. When a user clicks on the password tab to change the password, he/she is redirected to the user edit page an the password cannot be changed.

roball’s picture

roball commented
Title: Unable to reset password with Password Change Tab module enabled » Unable to (re)set password when "Password change tab" module is enabled
Component: User interface » Code
StatusFileSize
new 02.Your password has expired - Redirection to Account tab.png172.35 KB
new 01.Click Password tab.png171.32 KB

Can confirm this bug is still present in the latest 6.x-1.x release (6.x-1.5), and it's clearly critical!

The other issue #1189756: Changing location of password tab in password_policy_password_tab has broken functionality in password_policy fixed another problem, and it was reported later than this one, so this one is not a duplicate.

Here are the steps to reproduce:

1. Originally log in by clicking the one-time login link received per email
(user/reset/[UID]/[TIMESTAMP]/[TOKEN]) due to an admin-created new account.

2. Do NOT set your password and log out. Wait until the password has expired (probably on the next day).

3. Request a password reset (at user/password) and click on the received new one-time login link.

Then the password_policy module gives the message "Your password has expired. You must change your password to proceed on the site." and redirects all requests to "user/[UID]/edit", however the password can only be changed at "user/[UID]/edit/password" (see attached screenshots).

Thus it is impossible to ever set a password or proceed on the site. So I had to disable the password_policy_password_tab module on all sites.

erikwebb’s picture

erikwebb commented

Do we know exactly what the cause is? A solution is probably to clear out any expiration warnings when a password reset is used. Do you think this would solve the problem?

Also - let's look at 7.x-1.x and see if there is a problem there as well.

roball’s picture

roball commented

Thank you for your rapid response. Yes, I think the problem would be solved when password_policy does not interfere with core's user.module at all when handling one-time logins expirations.

erikwebb’s picture

erikwebb commented
Status: Active » Needs review
StatusFileSize
new password_policy-1188264-password_tab_reset-7.patch731 bytes

I've done some research on this one...

It looks like it's a combination of problems. I believe this was not an issue until I ported a D7 patch incorrectly in #1424324: Make password redirect URL overridable. Mentioned in the top of this issue, artkon actually re-fixed the D6 issue. I've re-posted his patch here.

I may be off base here, but I think the real problem is with the redirect and not the one-time login behavior.

Status: Needs review » Needs work

The last submitted patch, password_policy-1188264-password_tab_reset-7.patch, failed testing.

erikwebb’s picture

erikwebb commented
Status: Needs work » Needs review
StatusFileSize
new password_policy-1188264-password_tab_reset-9.patch733 bytes
roball’s picture

roball commented

Thank you for working on that fix. I will test it once time permits.

aohrvetpv’s picture

aohrvetpv commented
Version: 6.x-1.5 » 6.x-1.x-dev
Issue summary: View changes
Status: Needs review » Reviewed & tested by the community

Tested the patch and it seems to work. As was said earlier in the issue, it seems like the problem was actually with redirection for a forced password change (due to expiration or manually forcing a password change). The problem does not seem to be with one-time login links in general.

I reproduced the problem as follows:
1. Logged in as admin.
2. Checked "Force password change on next login." for user 'foo' and saved.
3. Logged out.
4. Logged in as user 'foo'. Was redirected to nonexistent page /password and attempting to go to another page redirected back to /password.

aohrvetpv’s picture

aohrvetpv commented

Duplicate of #2157555: Password Change URL is Nonexistent When Force Password Change is Checked.

aohrvetpv’s picture

aohrvetpv commented
Status: Reviewed & tested by the community » Fixed

Adapted fix in #9 to the latest code and committed/pushed.

  • Commit 27b5767 on 6.x-1.x by AohRveTPV: 
    Issue #1188264 by erikwebb, AohRveTPV: Unable to (re)set password when "...

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.