In the Eventsubscriber there is a list of user pages to be excluded from the module but this does not include the route 'user.reset.login'.

CommentFileSizeAuthor
#4 require_login-password_reset-2866004-4.patch753 bytesgmaxwelled
#2 require_login-password_reset-2866004-2-D8.patch743 bytesjamiehollern
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

jamiehollern created an issue. See original summary.

jamiehollern’s picture

jamiehollern
he/him
Primary language English
Location Alba/Scotland
CreditAttribution: jamiehollern as a volunteer commented
Status: Active » Needs review
FileSize
require_login-password_reset-2866004-2-D8.patch743 bytes

Added patch.

TommyK’s picture

TommyK CreditAttribution: TommyK as a volunteer and commented

Would we need to include all the reset password link paths? Looking in the user module there are a number of user.reset routes.

Maybe something like:

substr($route_name, 0, 10) === 'user.reset')

gmaxwelled’s picture

gmaxwelled CreditAttribution: gmaxwelled commented
Priority: Normal » Major
FileSize
require_login-password_reset-2866004-4.patch753 bytes

Combining the original patch with TommyK's suggestion does the trick for me. Here is an updated patch.

Also changing priority to Major, as this bug prevents users from using the forgotten password functionality.

Arrow’s picture

Arrow
Location Chicago
CreditAttribution: Arrow commented
Status: Needs review » Reviewed & tested by the community

#4 did the trick for me!

gigiabba’s picture

gigiabba CreditAttribution: gigiabba at Ibuildings commented

Please apply the patch. #RTBC

dqd’s picture

dqd
(formerly "diqidoq")
CreditAttribution: dqd as a volunteer and commented

We need maintainer action here and on other 8.x issues. I will contact robphillips or Jeffrey C. to get commit access. Let's make this module ready for the ride ...

robphillips’s picture

robphillips CreditAttribution: robphillips commented

Hello. I've recently been occupied with client work, so my apologies for lack of maintenance releases. I'll be reviewing issues today and will determine if an additional maintainer will be necessary. In terms of a roadmap, aiming to have a new beta release ready by EOD.

robphillips’s picture

robphillips CreditAttribution: robphillips commented
Status: Reviewed & tested by the community » Closed (cannot reproduce)

I'm unable to replicate this issue with Drupal 8.5.3. Furthermore, the $route_name given on the reset password page is "user.pass". The "user.pass" route is already excluded from the access restrictions. If anyone reports this issue again, please provide additional information for replication purposes (Drupal version, contrib modules, theme, etc).

dqd’s picture

dqd
(formerly "diqidoq")
CreditAttribution: dqd as a volunteer and commented

@robphillips: Great to have you back.

my apologies for lack of maintenance releases.

No need to apologize. Thanks for clarification. Absolutely understandable reasons. Thanks for chiming in and having a look. Don't worry. It is all about the interest getting Drupal 8 contrib area ready ;-) We will help if required.

#4: Also changing priority to Major, as this bug prevents users from using the forgotten password functionality.

robphillips: I'm unable to replicate this issue with Drupal 8.5.3. Furthermore, the $route_name given on the reset password page is "user.pass". The "user.pass" route is already excluded from the access restrictions.

@robphillips: Did you made enough tests and can you confirm that you have no issues with the usability like the test of #4 is mentioning?

robphillips’s picture

robphillips CreditAttribution: robphillips commented
Status: Closed (cannot reproduce) » Active

robphillips’s picture

robphillips CreditAttribution: robphillips commented
Status: Active » Fixed

Patch #4 committed. I was previously only testing access to the reset password form. I found that "user.reset" route name is used when clicking the reset password email confirmation link. New release will be out shortly.

robphillips’s picture

robphillips CreditAttribution: robphillips commented
Status: Fixed » Closed (fixed)
dqd’s picture

dqd
(formerly "diqidoq")
CreditAttribution: dqd as a volunteer and commented

1+! Awesome work on this, Rob.