Headers output after password request

this bug still exists in the 4.6.0 version

the full error is

 warning: Cannot modify header information - headers already sent by 
 (output started at  /var/www/drupal/drupal-4.6.5/modules/securesite/securesite.inc:39) in  
 /var/www/drupal/drupal-4.6.5/modules/securesite/securesite.module on line 66.

Try removing the securesite_goto(); on line 45 in the securesite.inc file. It is printing out error messages on line 39 and 43, then it is redirecting on line 45. This redirect should be unnecessary since you would want the users to see the message. The exit on line 56 should end page output.

While that does fix the error message, it also leaves me on the logout page. So, if I try to reload the page, I'll end up resubmitting the POST information from the form and my password will change again. If I try to go back to the password form page and reload, I get logged out immediately (since I'm on the logout page). There needs to be a redirect.

I think I've solved this. I left the _goto() in place and added in a session variable. At the top of _init(), if that variable is set, I output the password message and exit(). Seems to work well.

This approach also makes it possible to simply reload the page showing the password message to get an auth dialog. That didn't work before (probably because the _goto() failed).

Here's a patch for HEAD.

Committed to DRUPAL-4-7 and HEAD. The 4.6 patch won't commit after the patch for issue 28408 was applied.

Committed to DRUPAL-4-6.