The features we wanted was ignoring the force change password for admin. This force change is triggered by a user reset link (user-login/uli).

Currently the module only ignores expires for admin. I added a option to ignore all force changes for admin.

CommentFileSizeAuthor
#2 password_policy_2572627_admin_force_change.patch2.96 KBericpinxteren

Comments

ericpinxteren created an issue. See original summary.

ericpinxteren’s picture

ericpinxteren commented
StatusFileSize
new password_policy_2572627_admin_force_change.patch2.96 KB

Status: Needs review » Needs work

The last submitted patch, 2: password_policy_2572627_admin_force_change.patch, failed testing.

aohrvetpv’s picture

aohrvetpv commented

ericpinxteren, why do you use the "Force password change on reset" feature?

I began working on this module a little over a year ago, and am not sure what the purpose of that feature is. (I understand this patch is just to add an option to make an exception for uid 1, but I would like to understand the purpose of the feature.)

I suppose "Force password change on reset" could mitigate unauthorized access by an attacker who requests password reset links from a compromised e-mail address, since the attacker would have to change the password, which would let the authentic user know that something is wrong when they cannot log in with their password.

mkoma’s picture

mkoma commented

Thank You ! It's working .. I had problem because I'm using Password Separate Form module.

mkoma’s picture

mkoma commented
Status: Needs work » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.