There seems to be a small issue with user_pass_reset on line 98
and onward. user_load is called with status == 1 as a parameter but then on
line 100 a check is made to see if the user account is blocked. That
condition will then of course never be true.

Code excerpt:

   if ($timestamp < $current && $account = user_load(array('uid' => $uid,
'status' => 1)) ) {
     // Deny one-time login to blocked accounts.
     if (drupal_is_denied('user', $account->name) ||
drupal_is_denied('mail', $account->mail)) {
       drupal_set_message(t('You have tried to use a one-time login for
an account which has been blocked.'), 'error');
       drupal_goto();
     }

Comments

andrewjsledge’s picture

Status: Closed (works as designed) » Active

These are two different checks. The first check you are referring to on line 98 looks at the users table and establishes whether the user is not blocked. The second check you are referring to on line 100 looks at the access table (via the drupal_is_denied function) to verify that that there is no access control in place via the user rules to prevent the user from performing this function. The two are mutually exclusive. However, the comment on line 99 should probably go above the existing line 98.

andrewjsledge’s picture

Assigned: Unassigned » andrewjsledge
Status: Active » Closed (works as designed)
Issue tags: +authentication, +access control

Status: Active » Closed (works as designed)