Closed (fixed)
Project:
Force Password Change
Version:
6.x-3.1
Component:
Code
Priority:
Normal
Category:
Bug report
Assigned:
Unassigned
Reporter:
Created:
11 Sep 2010 at 13:40 UTC
Updated:
6 Oct 2010 at 04:40 UTC
Any time a user with administer users perms saves another user edit form, the last password change is updated with the current time. Additionally, the user is reported to have been forces to change his pass.
The following code from the hook_user implementation shold only run if the $edit['pass'] is not empty. And maybe it should only run if the user himself changes it.
case 'update':
if($edit['pass'] != $account->pass)
{
db_query
(
'UPDATE {force_password_change_users} SET last_password_change = %d WHERE uid = %d',
time(),
$account->uid
);
}
I'm also seeing a related bug where I can't force an individual user to change her pass even though I set it to be forced on her user page. I will create another issue when I figure that one out.
Comments
Comment #1
jaypanYou're right, that should only be run if $edit['pass'] isn't empty. I'll add that in the next version of the module.
But the other part of that - only resetting the time if the user changes their password and not the admin, that's by design and not something to change. The function is for checking when the password has been changed. If the admin has changed the password, then it has been changed. Forcing the user to do it soon afterwards just because the password wasn't changed by them forces their password to be changed more often than necessary.
Comment #2
awolfey commentedIn that case maybe a change in the text displayed is needed.
Even if the admin changes a user's password, the text still says that the user made the change.
http://gyazo.com/bdd653f537fcaf03ce24b8112d5846c4.png
Comment #3
jaypanGood call. I'll change it to 'user's password was last changed on ____'.
Comment #4
jaypanI have added the check to see if the password is empty or not, as well as changed the text in version 6.x-3.2. Thank you for your contributions.