When someone gets a 403 error, sends a password reset, and logs in with the "forgot my password" password reset one-time login link, they are taken directly to the page on which they initially got access denied— no chance to change their password.

Drupal meanwhile loses the password reset token from the query parameter, and so when the user does go to their account page to change their password, they are asked to enter their old password to set a new one— which is rather inconvenient when they have forgotten their old password, which is why they used the password reset link in the first place.

CommentFileSizeAuthor
#1 2345967-custom-error-redirect-before-can-set-forgotten-password.patch2.37 KBmlncn

Comments

mlncn’s picture

mlncn commented
StatusFileSize
new 2345967-custom-error-redirect-before-can-set-forgotten-password.patch2.37 KB

This patch solves this issue. In the process:

  • It alters drupal_goto rather than user_login, using less code while adding a check for the password reset token (and setting the destination for later redirect rather than taking over the goto right then).
  • It uses the customerror namespace for storage of the destination in the global session variable.
  • It only sets a destination in the session if the user is logged out (and so has hope of having a different result on going to that access denied location when logging in).

It seems solid at always getting the user back to the page access denied was encountered on after logging in, while letting users who use the password reset one-time login link go to their account page to reset their password first. Tested to ensure the issue solved (in 7.x) in #825860: Logging in on 403 page does not work isn't reintroduced.

mlncn’s picture

mlncn commented
Status: Active » Needs review

  • gisle committed ccb6974 on 7.x-1.x authored by mlncn 
    Issue #2345967 by mlncn: Fixed redirect to page on which 403 error...
gisle’s picture

gisle
he/him
Primary language Norwegian Bokmål
Location Norway
commented

Thanks for the patch mlncn!

I've tested it, and it looks fine. It has been committed to the 7.x-1.x-dev branch.

I'd prefer that a third person tests it and gives it the status RTBC before pushing it in a regular release.

gisle’s picture

gisle
he/him
Primary language Norwegian Bokmål
Location Norway
commented
Status: Needs review » Reviewed & tested by the community
Related issues: +#1007200: Password reset procedure no longer works when installed + activated

Reviewed in #1007200: Password reset procedure no longer works when installed + activated.

gisle’s picture

gisle
he/him
Primary language Norwegian Bokmål
Location Norway
commented
Version: 7.x-1.x-dev » 7.x-1.3
Status: Reviewed & tested by the community » Fixed

Fixed in release 7.x-1.3.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.