I was having this issue on a site I was working on. To confirm that it was not a conflict with another module, I have a fresh install of Drupal 7.28, Password policy 7.x-1.8 and SMTP 7.x-1.0 so that I could send the password reset email.

First time the user must enter a new password, then the page comes back and says the password is expired and they have to enter a new one again.

CommentFileSizeAuthor
#3 password_policy-fix_force_change_on_reset-2294261-3.patch733 bytesaohrvetpv

Comments

mineshaftgap’s picture

mineshaftgap commented

I just took off the "Force password change on reset" switch, and now after requesting a reset and using the reset link I am told my the password is immediately expired.

It appears that the force was from the force_change being left in the table password_policy_force_change from the previous go.

Original issue is still open.

aohrvetpv’s picture

aohrvetpv commented

Reproduced it with these steps:
1. Install Password Policy.
2. On admin/config/people/password_policy, check "Force password change on reset". Press "Save configuration".
3. Create user 'foo'.
4. drush user-login foo. Follow link.
5. Change password.
6. Attempt to browse to another page.

aohrvetpv’s picture

aohrvetpv commented
Status: Active » Needs review
StatusFileSize
new password_policy-fix_force_change_on_reset-2294261-3.patch733 bytes

Please try this patch.

aohrvetpv’s picture

aohrvetpv commented
Title: Reset password forces you to change password twice » "Force password change on reset" can require changing password twice
Version: 7.x-1.8 » 7.x-1.x-dev

The "Force password change on reset" feature uses hook_drupal_goto_alter() to detect use of a one-time login link. If a one-time login link was used, and "Force password change on reset" is enabled, the user is flagged for a forced password change in the database.

The problem seems to be with the condition that detects use of a one-time login link. It checks just for pass-reset-token in the query part of the URL. This works initially, but when the user changes their password on the user-edit page, they are redirected back to the same URL via drupal_goto(). Since pass-reset-token is still in the URL, the user is again flagged to change their password.

A fix seems to be to also check for the $_SESSION['pass_reset_' . $user->uid] variable before flagging the user for a forced password change. This variable will be unset after the user changes their password the first time.

aohrvetpv’s picture

aohrvetpv commented

Opened new, related issue: #2294535: No tests for "Force password change on reset"

mineshaftgap’s picture

mineshaftgap commented

added comment to update.

mineshaftgap’s picture

mineshaftgap commented
Status: Needs review » Needs work

I think this is getting close, unfortunately there is still an issue with the patch above, when users try and visit another page first.

Repro:
1. Request new password
2. Go to password link
3. Click Login, redirected to user edit
4. Don't submit form on user edit but instead hit the home page
5. User is not on user edit including the "Current Password" form field which of course is not known.

aohrvetpv’s picture

aohrvetpv commented

Thanks for trying out the patch. The behavior you describe is the same as with Drupal core. Without Password Policy installed, if a user follows your steps 1-4, then browses to the user-edit page, they will also be prompted for a current password.

It would seem to be an improvement to allow a user to browse away from the user-edit page, return, and not be prompted for their current password. Should it not be implemented in Drupal core, though?

mineshaftgap’s picture

mineshaftgap commented

Yes I agree, this would be ideally in core, I was thinking that this was the intent behind this feature. Are you saying it is not something you think can/should be done in Password Policy?

aohrvetpv’s picture

aohrvetpv commented

The intent of the feature was to prevent the situation where a user who has forgotten their password uses a one-time login link, but browses the site without actually changing their password, causing them to be unable to log in the next time they visit the site. I think the current code at least minimally satisfies that intent, since they are forced to change their password before browsing the site. Issue that introduced the feature:
#1051390: Make option for password reset request to force password change

Yes, I was questioning whether this should be done in Password Policy. Thinking about it further, it seems unlikely this behavior change to D7 would be accepted at this point in D7's development. It also may be easier to implement in Password Policy for just this setting, since the pass-reset-token parameter would not have to be kept across visits to other pages. So I opened a new issue to make this change:
#2295271: When forcing password change on reset, browsing away produces current password field

Will plan to commit the patch in #3 to fix this issue, which I think is separable from #2295271: When forcing password change on reset, browsing away produces current password field.

aohrvetpv’s picture

aohrvetpv commented
Status: Needs work » Needs review

  • AohRveTPV committed 7926de2 on 7.x-1.x 
    Issue #2294261 by AohRveTPV, mineshaftgap: "Force password change on...
aohrvetpv’s picture

aohrvetpv commented
Status: Needs review » Fixed

"Force password change on reset" setting exists neither in 6.x-1.x nor 7.x-2.x.

aohrvetpv’s picture

aohrvetpv commented

mineshaftgap, please review and/or test the patch in #2295271-4: When forcing password change on reset, browsing away produces current password field, which addresses the issue you mentioned in #7, if you have a chance.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.