The test at line 288 of force_password_change.module assumes that the user is always required to enter their current password when changing their password. If this isn't the case, the test never passes and they are eternally forced back to their profile page.
The patch I'll attach after creating this issue addresses this by moving the check into a new user_presave hook, where validation of the new password has already occurred and we just need to check that the password is the field that has changed.
| Comment | File | Size | Author |
|---|---|---|---|
| #7 | 3160663-7.patch | 674 bytes | laisbonafe |
| #6 | focepasswordChange.png | 101.05 KB | laisbonafe |
| #4 | Issue-3160663-4-Per-user-flag-never-reset.patch | 3.03 KB | nigelcunningham |
| #3 | Issue-3160663-3-Per-user-flag-never-reset-if-current-p.patch | 3.06 KB | nigelcunningham |
| #2 | Issue-3160663-Per-user-flag-never-reset-if-current-p.patch | 2.86 KB | nigelcunningham |
Comments
Comment #2
nigelcunningham commentedComment #3
nigelcunningham commentedMissed including the use when cleaning up the commit.
Comment #4
nigelcunningham commentedAdd a check that $user->original is actually set - the hook can be triggered for a new user too.
Comment #5
larisse commentedThis still a problem in 2.0.x version?
Comment #6
laisbonafe commentedIf the admin don't create a password for the new user . the function force password in the first login don't have been enable, in this case the new user should be create the password for the link is send in email, if the admin creat a password for the new user, the admin should be send the password created for the user, befor enable the function force password in the first login. The module is working well i just think need a more informaion about this functionality (force password in firsr login).
Comment #7
laisbonafe commentedI did a patch for create more informations about the functionality (force password change in first login).
Comment #9
larisse commented@laisbonafe is right. The Force password change on first-time login have to be enabled when the admin set a password for the user and the user know this password.
I think this issue can be related with this other issue #2922398: Unable to reset my password.