The Problem

In some payment implementations(e.g: Mollie), the payment happens outside of the current domain.
Due to this, the programmatical way of login the user - fails.
The problem is that the function user_login_finalize() is always called which will reset the session for the newly created user AND this will bring us to the problem that the reset password link sent in the email earlier is not valid anymore.

Solution

Add configuration ability either to login or not the user after the checkout so the user_login_finalize() is not called.

CommentFileSizeAuthor
#3 interdiff-2832144-2-3.txt987 bytest-lo
#3 Invalid_Reset_password-2832144-3.patch1.46 KBt-lo
#2 Invalid_Reset_password-2832144-2.patch1.34 KBhugronaphor

Comments

hugronaphor created an issue. See original summary.

hugronaphor’s picture

hugronaphor commented
Status: Active » Needs work
StatusFileSize
new Invalid_Reset_password-2832144-2.patch1.34 KB

Adding a patch controlling this with the variable ccl_login_user_on_checkout as proof.

t-lo’s picture

t-lo
Primary language English
Location Bristol, UK
commented
Status: Needs work » Needs review
StatusFileSize
new Invalid_Reset_password-2832144-3.patch1.46 KB
new interdiff-2832144-2-3.txt987 bytes

Confirmed this fixes the above issue but I found that this caused the following issue:
Users filling in the checkout login form were not logged in

So, I've changed it to only take affect on the newly registered users.

matthiasm11’s picture

matthiasm11 commented

Using the patch from #3 with beta2.

christianr4’s picture

christianr4 commented

Using the latest patch doesn't resolve the issue for me. The one-time URL always refers to the password reset page. Do I have to change anything else next to applying the patch?

hugronaphor’s picture

hugronaphor commented

@christianr4, did you set the variable to FALSE?

variable_set('ccl_login_user_on_checkout', FALSE);
or
drush vset ccl_login_user_on_checkout FALSE