Ok, here is the scenario

new user is created and sent an email to which comes back to the site where the user is asked to rest their password. At this ount in time ijust show the password and confirm password field which is great.

The user adds a password and types in the confirm password then... I go to the same page this time telling the user that they need to change their password because the administrator wants the user to reset their password on the first login, and now it shows the 3 fields original password the new and confirm password field.

this issue is the user has and as part of the email process has changed their password on the first login and there is no need to repeat the process immediately after logging and changing the password via the email link.

I haven't looked at the code yet and was wondering if anyone already had a solution.

thanks

Comments

erikwebb’s picture

erikwebb commented

Are you saying this is happening immediately one after the other?
- User creates initial password, attempts to navigate to another page, another change is forced

Or that this may happen at their next login?
- User creates initial password, logs out or leaves the site, on next login another change is forced

chaloum’s picture

chaloum commented

Yes it happens imediatly in succession one after the other it asks you to change the password then imediatly asks again event though the first time it said the change had been saved.

The chage password is actually saved so the second time you have to use the password that was entered in the first loop.

erikwebb’s picture

erikwebb commented
Title: strange workflow » Password reset required after new account password creation
erikwebb’s picture

erikwebb commented
Status: Active » Postponed (maintainer needs more info)

I think this might actually be solved indirectly by #1452280: Force password change broken for 'administrators'. Could you confirm?

aohrvetpv’s picture

aohrvetpv commented
Issue summary: View changes
Status: Postponed (maintainer needs more info) » Closed (cannot reproduce)
  1. Check "Force password change on first-time login" and save.
  2. Set the following account settings:
    • Who can register accounts: Visitors
    • Require e-mail verification when a visitor creates an account.
  3. Log out.
  4. Create new account 'foo'.
  5. Browse to e-mailed password reset link.
  6. Type password twice and save.
  7. User is redirected to user/X/edit. User can browse away from this page without being forced to change their password.

The redirection back to the user-edit page in the last step is the same as without the Password Policy module installed for the same account settings. So if you think it is a problem that the user is redirected back to the user-edit page after setting their password, it would seem to be a core problem, not a Password Policy problem.

Please re-open the issue with clarification if you think this is a problem that does not also occur without Password Policy installed.