Empty state user agent value results in false positive, redirects all non-crawlers to user/login

Created on 10 September 2023, 10 months ago
Updated 20 September 2023, 9 months ago

Problem/Motivation

We ran into an unexpected issue after we started using this module in that users started reporting that they weren't able to reset their passwords because they'd be redirected to the log in page every time. It took me a lot of digging to figure out that it was this module that was causing it, and you can see the full details in our GitHub issue, but to summarize: this module creates a regular expression even when the state value is empty, and when the state value is empty, that regular expression will match any and all user agents, including the ones you don't want to block, i.e. real users. It looks like this functionality was added in ✨ Exclusion of individual user agents Fixed .

Steps to reproduce

  1. Install this module
  2. Don't set any value in the individual user agents form/state value
  3. Request a password reset
  4. Follow the link that was emailed to you
  5. You should now always find yourself on user/login instead of user/reset/{uid}

Proposed resolution

Add a check in ShyOneTimeState::checkUserAgents() before creating the regular expression to ignore any zero length strings. Also add one or more tests because this could have been easily caught by them.

Remaining tasks

See previous heading.

User interface changes

You see the password reset page instead of user/login

API changes

None.

Data model changes

None.

πŸ› Bug report
Status

Fixed

Version

2.0

Component

Code

Created by

πŸ‡¨πŸ‡¦Canada Ambient.Impact Toronto

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Production build 0.69.0 2024