Creating a password policy that includes the variable to only allow a user to change their password once every 24 hours works flawlessly except when a user goes to reset their password.

Drupal core (I assume) resets the password for the user and then sends them the one-time log in link. The user then is prompted to change their password. They are then unable to change their password within the 24 hour window because drupal core just changed it.

An exception to the 24 hour rule should be made when drupal core is changing the user's password so this doesn't trigger the event. A seperate configurable should also be implemented to disable the ability for a user to reset their password as many times as they wish via the one-time link system.

Comments

Traverus’s picture

Traverus commented

Another way to solve this would be to add a configurable to allow X number of password changes in X time (e.g. 2 in 24 hours)

erikwebb’s picture

erikwebb commented
Version: 7.x-2.x-dev » 7.x-1.x-dev

If this is a bug, it's probably referring to 7.x-1.x

erikwebb’s picture

erikwebb commented
Status: Active » Postponed

This is related to #1596960: Force password change on first-time login requires password to change

I need to fix the other issue before this can be resolved.

erikwebb’s picture

erikwebb commented
Status: Postponed » Postponed (maintainer needs more info)

Can this be added on to the work in #1468172: "Delay" constraint combined with "Force password change on next login" can result in a temporary catch-22 for the user?

slefevre1’s picture

slefevre1 commented
Version: 7.x-1.x-dev » 7.x-1.6
Issue summary: View changes
Status: Postponed (maintainer needs more info) » Active

I seem to have just encountered this in version 7.x-1.6. I went to /user/pass to get the password reset link, and then on the /user/edit page, I get `Your password has not met the following requirement(s): Password may only be changed in 24 hours from the last change.`

aohrvetpv’s picture

aohrvetpv commented
Status: Active » Postponed (maintainer needs more info)

Cannot reproduce:
1. Download/enable 7.x-1.6.
2. Log in as administrator.
3. Create policy with delay 24.
4. Enable policy.
5. Log out.
6. Request password reset for user 'foo'.
7. Browse to received password reset URL.
8. Change password successfully.

What are you doing differently? Am I misunderstanding the problem?

If you are performing the same steps but getting a different result, something must be different about your configuration, so please give steps for reproducing the problem from a freshly installed Drupal 7 site.

aohrvetpv’s picture

aohrvetpv commented
Status: Postponed (maintainer needs more info) » Closed (cannot reproduce)

A month has passed with no information on how to reproduce this. Please re-open if you still have this issue.