- Merge request !151Issue #3097238: Protect initial login link against abuse → (Open) created by roderik
- First commit to issue fork.
- last update
over 2 years ago 29,565 pass - Status changed to Needs review
over 2 years ago 7:03am 30 June 2023 - last update
over 2 years ago 29,566 pass - 🇨🇦Canada Charlie ChX Negyesi 🍁Canada
Serving as the Ghost of Drupal Past, as I am sure everyone remembers ;) José added this not long ago ;) in #18719: Request New Password Security → with a little dabbling from me but even I can't recall the reason for no timeout on first login. Re-reading the issue, it was introduced in #14 but there's no reasoning given. Considering some use cases here... for example you might be registering on an event website months ahead, get a link and never bother to go through with the actual account creation until the event comes. if we consider this a valid use case then maybe we should add instructions on how to obtain a fresh reset link -- AFAIK currently the only way in the web UI is to visit user/reset, enter the username and click... so maybe we should consider adding username prefill functionality to the user reset page and add instructions to the initial user mail?
- Status changed to Needs work
over 2 years ago 11:58pm 2 July 2023 - 🇺🇸United States smustgrave
This seems like something that could use an issue summary update.
Is the same approach from 3 years ago still desired?
- last update
almost 2 years ago 25,746 pass, 1,791 fail - First commit to issue fork.
The Needs Review Queue Bot → tested this issue. It no longer applies to Drupal core. Therefore, this issue status is now "Needs work".
This does not mean that the patch necessarily needs to be re-rolled or the MR rebased. Read the Issue Summary, the issue tags and the latest discussion here to determine what needs to be done.
Consult the Drupal Contributor Guide → to find step-by-step guides for working with issues.
The Needs Review Queue Bot → tested this issue. It no longer applies to Drupal core. Therefore, this issue status is now "Needs work".
This does not mean that the patch necessarily needs to be re-rolled or the MR rebased. Read the Issue Summary, the issue tags and the latest discussion here to determine what needs to be done.
Consult the Drupal Contributor Guide → to find step-by-step guides for working with issues.
- 🇫🇷France prudloff Lille
I think we need a followup for the todo (remove deprecated code branch in UserPasswordResetForm).
