When the "Force password change on reset" setting is enabled, a user who uses a one-time login link is forced to change their password before browsing the site beyond the user-edit page. If they attempt to visit another page on the site, they are redirected back to the user-edit page to change their password. However, the "Current password" field appears after redirection, and the current password is likely to be unknown to the user.

It would be better if the "Current password" field did not appear after redirection, and the user could still change their password even if it is unknown to them.

CommentFileSizeAuthor
#4 password_policy-remove_current_password_field-2295271-4.patch2.9 KBaohrvetpv
#3 password_policy-remove_current_password_field-2295271-3.patch2.87 KBaohrvetpv
#2 password_policy-remove_current_password_field-2295271-2.patch580 bytesaohrvetpv

Comments

aohrvetpv’s picture

aohrvetpv commented
Title: When forcing password change on reset, browsing away can produce current password field » When forcing password change on reset, browsing away produces current password field
aohrvetpv’s picture

aohrvetpv commented
StatusFileSize
new password_policy-remove_current_password_field-2295271-2.patch580 bytes

A committable patch will minimally include and satisfy this changed test.

aohrvetpv’s picture

aohrvetpv commented
Status: Active » Needs review
StatusFileSize
new password_policy-remove_current_password_field-2295271-3.patch2.87 KB

This patch attempts to implement this by extracting the pass-reset-token query parameter from the HTTP referer header and adding it to the query for the password change page request. (The pass-reset-token query parameter is needed to suppress the current password field.)

aohrvetpv’s picture

aohrvetpv commented
StatusFileSize
new password_policy-remove_current_password_field-2295271-4.patch2.9 KB

Previous patch was broken.

The last submitted patch, 3: password_policy-remove_current_password_field-2295271-3.patch, failed testing.

  • AohRveTPV committed 3b24d13 on 7.x-1.x 
    Issue #2295271 by AohRveTPV: When forcing password change on reset,...
aohrvetpv’s picture

aohrvetpv commented
Version: 7.x-1.x-dev » 6.x-1.x-dev
Status: Needs review » Patch (to be ported)

Have given ample time for review, and this might fix a problem another person is having, so committed. Need to decide whether this should be implemented in D6.

  • AohRveTPV committed 3b24d13 on 8.x-1.x 
    Issue #2295271 by AohRveTPV: When forcing password change on reset,...
aohrvetpv’s picture

aohrvetpv commented
Status: Patch (to be ported) » Closed (outdated)

6.x-1.x is no longer supported.