Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.At present, if someone requests a password reset and submits one of their alternate e-mail addresses, Drupal tells the user that the account doesn't exist. Yet, if they try to register the account with that same email address, they are denied because the e-mail address is in the system. It would be great if a password reset form could also search among the alternate email addresses for the account and allow for resetting via the alternate e-mail.
There are security implications for this fix, it would be best if it was configurable as to whether or not its in effect.
| Comment | File | Size | Author |
|---|---|---|---|
| #7 | multiple_email-play_nice_with_password_reset-2463935-7.patch | 3.94 KB | deetergp |
| #4 | multiple_email-play_nice_with_password_reset-2463935-4-7.patch | 3.07 KB | deetergp |
Comments
Comment #1
tvn commentedComment #2
tvn commentedComment #3
deetergp commentedComment #4
deetergp commentedI took this ticket on an embarrassingly long time ago; at the Friday sprint at DrupalCon LA. I had to duck out a little early then, but I finally got some time to take a swing at it this past weekend.
The functionality of it works, in theory, at least. I used
$conf['mail_system'] = array('default-system' => 'DevelMailLog');for routing my mail, but it appears to be going to the correct recipient when alternate email addresses get entered. I have also added a yes/no setting for enabling this ability.Comment #5
deetergp commentedComment #6
drummIn this case, let's fall back to the generic error message set by
user_pass_validate(). No need to provide extra information about an email's status.The main password reset does send reset emails to unconfirmed email addresses, let's make that an option, so the yes/no choice becomes:
$language = $GLOBALS['language'];is unused and can be removed.Comment #7
deetergp commentedGood idea on the three options. Give this one a try.
Comment #8
deetergp commentedComment #9
drummCommitted with a bit of code cleanup. Thanks!
Comment #11
drummComment #12
drummDrupal.org now allows resets for confirmed email addresses.
Comment #13
tvn commentedHooray! Thanks deetergp!
Comment #14
darrellduane commentedYes, Hooray, Thanks deetergp & drumm!