!login_url not a one-time link? [#330223]

Comment #1

danielb CreditAttribution: danielb commented 5 November 2008 at 00:25

Version:

6.x-dev

» 6.6

Log in or register to post comments

Comment #2

danielb CreditAttribution: danielb commented 5 November 2008 at 00:34

FYI I am aware of the algorithm in the user module that invalidates the login hash by updating the login time. I think it might work for password resets - but I've definilty witnessed it working as describe in my first post today.
If it helps I've also got login tabbogan installed - that wouldn't hurt anything though, right?

Log in or register to post comments

Comment #3

ainigma32 CreditAttribution: ainigma32 commented 17 December 2008 at 14:03

Status:

Active

» Postponed (maintainer needs more info)

@danielb: I can't find other issues that mention similar problems. Can you confirm this behavior still exists with the latest version of D6?

- Arie

Log in or register to post comments

Comment #4

ainigma32 CreditAttribution: ainigma32 commented 31 December 2008 at 14:23

Status:

Postponed (maintainer needs more info)

» Fixed

Looks like danielb won't be posting any feedback so I'm setting this to fixed.

Feel free to reopen if you think that is wrong.

- Arie

Log in or register to post comments

Comment #5

danielb CreditAttribution: danielb commented 11 January 2009 at 22:49

Status:

Fixed

» Active

Why do I have to be the one to investigate this? I have a fairly recent version of drupal 6 - if it's been fixed since then - why can't you find an issue about it?

Log in or register to post comments

Comment #6

Damien Tournoud CreditAttribution: Damien Tournoud commented 12 January 2009 at 00:02

Status:

Active

» Postponed (maintainer needs more info)

I can't reproduce this issue neither on 5.x nor on 6.x.

Log in or register to post comments

Comment #7

danielb CreditAttribution: danielb commented 12 January 2009 at 03:07

Version:	6.6	» 6.8
Status:	Postponed (maintainer needs more info)	» Active

I just reproduced this problem in Drupal 6.8

1) register to the website
2) click the one-time link received in your email
3) log out from the site when it is presented
4) click the one-time link received in your email
3) log out from the site when it is presented

and you can keep going like this as much as you like.

(firefox 3.0.5)

Log in or register to post comments

Comment #8

danielb CreditAttribution: danielb commented 12 January 2009 at 03:24

Project:	Drupal core	» LoginToboggan
Version:	6.8	» 6.x-1.2
Component:	user.module	» User interface
Category:	support	» bug

The url I am clicking on is user/validate/15/1231729110/74329141cc61ab1dd93e2883be6cc0b9

The message I see is "You have just used your one-time login link. It is no longer necessary to use this link to login. Please change your password."

These are from Login Taboggan. Moving thread.

Log in or register to post comments

Comment #9

Bodo Maass CreditAttribution: Bodo Maass commented 21 January 2009 at 23:54

I just discovered the same problem on Drupal 5.15 with LoginToboggan 5.x-1.3. The "one-time" login links sent out by registration seem to work as often as I like when I log out after each login.

Log in or register to post comments

Comment #10

Bodo Maass CreditAttribution: Bodo Maass commented 22 January 2009 at 00:31

I submitted a patch that fixes this for 5.x-1.3 here: http://drupal.org/node/362332.

I don't have time to look at 6.x right now, but I guess it should be very easy to look at my patch for 5.x and apply it to 6.x.

Log in or register to post comments

Comment #11

hunmonk CreditAttribution: hunmonk commented 6 March 2009 at 05:14

Status:

Active

» Closed (duplicate)

this was fixed in #291001: Allow One Time Login To Be Used Only Once. i just re-tested, and it works flawlessly for me. marking this issue as a duplicate.