Problem/Motivation

The Guardian module, guards account so that passwords cannot be edited in the interface. If simple pass reset is turned on, this is circumvented by requesting a new password for the guarded account.

Steps to reproduce

  1. Turn on the Guardian module.
  2. Request a password via "/user/password" for user 1
  3. Click on the link in the e-mail to reset your password
  4. Now you can change the password for user 1 and this should not be the case

Proposed resolution

Detect if the Guardian module is used and if you try to login with a guarded account follow the regular process to login and skip the simple pass reset functionality.

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

mike.vindicate created an issue. See original summary.

michael.acampora’s picture

StatusFileSize
new1.51 KB

Attached patch that implements solution to skip simple pass reset when guardian is used for guarded accounts.

michael.acampora’s picture

StatusFileSize
new1.39 KB

Updated patch to be compatible with 1.3

tim-diels’s picture

Version: 8.x-1.1 » 8.x-1.x-dev
Status: Active » Needs review

So if I understand correctly, the 2 modules can work next to each other but should not do anything when Guardian is activated for an account? Would be good to have some kind of test or at least someone else can review this?

astonvictor made their first commit to this issue’s fork.

astonvictor’s picture

Version: 8.x-1.x-dev » 2.0.x-dev
astonvictor’s picture

I tested the patch and it works ok.

e.g. created a reset password link for the user 1 and can see the default button on the page. Then created the same reset password link for user 2 and can see the password field on the page.

As for me, the Guardian looks strange. It only has 160 usages, and it requires writing custom code.
e.g.
- you should implement hook_guardian_guarded_users() function to add other users (no UI);
- you cannot skip user 1 from protection, and there is no validation if the user exists;
- you should implement a hook/event to trigger the resetGuardedUsers() method to update the list of users.

The contrib module should not work in that way.

astonvictor’s picture

Status: Needs review » Fixed

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.