Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.This patch adds an else statement to warn the user if the security question hasn't been answered. It also provides a status message for the user to contact the administrator if the security question does not have a value.
| Comment | File | Size | Author |
|---|---|---|---|
| #1 | user_warning.patch | 2.28 KB | fmitchell |
| user_warning.patch | 1.64 KB | fmitchell |
Comments
Comment #1
fmitchell commentedFixed a bug in my patch.
Comment #2
Zen commentedWhat is this for? To cater for sites with existing users who haven't previously set their password_reset question? Would it not be better to force them to do it by redirecting them to the user edit page until they have done so?
What is the query change in your patch for?
Thanks,
-K
Comment #3
Zen commentedComment #4
fmitchell commentedThis is correct.
If one implements this module after having a set list of users or importing users from an upgrade or multi-site integration, having the warning is needed. Forcing users to do something, I think, is poor usability.
Comment #5
Zen commentedSeeing as to how this module forces this process on new users, I don't see this as being unusable. I'd personally find the nag message or as an admin, lots of reset requests, a lot more annoying.
Why the query change? Please also check your patch for coding standards issues ...
-K
Comment #6
sanduhrsAs far as I can see,
* existing user accounts get initialised with question number 1 and a hash value generated from the user's password and some salt.
* New users have to choose a question and a answer, when they sign up.
Nontheless, using modules like ucreate [1] produces users without question/answer, and creating users via ?q=admin/user/user/create produces users with questions and answers they probably don't know about.
I think a possible way to go could be
* Do not initialize existing users with q/a they don't know
* Instead _force_ them to choose a q/a after their next/first login
* Display a message above the request password q/a form to contact the administrator (optional contact form) if the answer is unknown
Any thoughts?
[1] http://drupal.org/project/ucreate
Comment #7
Zen commentedRedirect + Message feature added.
Cheers,
-K