One-time login link directs some users back to the /user/password page without logging them in

Created on 6 September 2021, about 3 years ago
Updated 5 May 2023, over 1 year ago

Problem/Motivation

When trying to confirm a new account or resetting an existing password an infinitive loop is created as the login after using the one-time login link could not be successfully performed.
When debugging the code I realized that the variable $action within user_pass_reset() is null as the hashed_pass is cut out of the url beforehand. Unless I just overlook something obvious this leads to the situation that $is_valid is never true, so that the user could not be logged in.

Steps to reproduce

Send email with password reset under /user/password, use link within the email and click at login

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

Release notes snippet

๐Ÿ› Bug report
Status

Postponed: needs info

Version

7.0 โšฐ๏ธ

Component
User moduleย  โ†’

Last updated 1 day ago

Created by

๐Ÿ‡ฉ๐Ÿ‡ชGermany smussbach

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024