password_policy_password_tab: Re-implementing core user_pass_reset() is not required and seems unsafe. [#992866]

user_pass_reset() seems to be a very security sensitive function that shouldn't be hijacked in contrib.

hook_exit() lets you react to the drupal_goto without duplicating the page callback.

Patch to follow.

Comment	File	Size	Author
#1	password_policy_password_tab-remove-user_pass_reset-99266-1.patch	5.72 KB	glennpratt

Comments

glennpratt commented 8 December 2010 at 20:41

Status	File	Size
new	password_policy_password_tab-remove-user_pass_reset-99266-1.patch	5.72 KB

At the same time, I moved the password change tab below user/%user/edit alongside account (user/%user/edit/password), similar to chngpwd module.

glennpratt commented 8 December 2010 at 20:43

Status:

Active

» Needs review

Up for review...

deekayen commented 15 April 2011 at 15:21

Committed to master.

deekayen commented 15 April 2011 at 15:22

Status:

Needs review

» Closed (fixed)

...and didn't change status.

glennpratt commented 15 April 2011 at 15:27

Thanks! I could see this affecting the D7 port as well, not sure.