Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.I realized while working on issue #1467184 that when an administrator creates an account, the created field gets set in the password_policy_history table. The Delay constraint checks that field when verifying whether a user is allowed to update their password.
If a delay constraint is in effect and the administrator checks the "Force password change on next login" box when creating a new account, the user is forced to change their password when they log in, but if the delay hasn't elapsed, they will be unable to change their password.
| Comment | File | Size | Author |
|---|---|---|---|
| #14 | password_policy-1468172-delay_catch_22-14.patch | 812 bytes | erikwebb |
| #3 | password_policy-avoid_catch_22-1468172-3.patch | 717 bytes | matt v. |
Comments
Comment #1
erikwebb commentedSo what's the resolution to this? Whenever the policy is updated, set a changed date for the delay constraint? What does the arithmetic look like there?
Comment #2
matt v. commentedMy initial thought was to bypass the delay constraint, if the account is marked "Force password change on next login." I can't think of a scenario where you'd genuinely want to force someone to change their password but also delay them from doing so.
What do you think?
Comment #3
matt v. commentedHere's a patch that bypasses the delay validation, if a user's account is marked "Force password change on next login."
This patch assumes password_policy-delay_constraint-1467184-2.patch has already been applied.
Comment #4
erikwebb commentedJust because I've run into issues in other patches. Can you confirm the force password change flag is reset after this is set?
Comment #5
matt v. commented@erikwebb, I'm not 100% sure I understand the question; however, I tested several manually created accounts with a delay set, both with and without the password change flag checked and I didn't encounter any issues. I also ran all the latest simpletests and they all passed.
Comment #7
erikwebb commented#3: password_policy-avoid_catch_22-1468172-3.patch queued for re-testing.
Comment #9
erikwebb commentedComment #10
erikwebb commented#3: password_policy-avoid_catch_22-1468172-3.patch queued for re-testing.
Comment #11
erikwebb commentedFixed and committed.
http://drupalcode.org/project/password_policy.git/commit/c9098d7
Comment #13
erikwebb commentedComment #14
erikwebb commentedComment #15
deekayen commentedComment #16
aohrvetpv commentedIssue does not affect 7.x-2.x since it does not (yet) have a "force password change at next login" feature.
Was committed on 6.x-1.x by deekayen:
http://drupalcode.org/project/password_policy.git/commit/b00f1a5