CI test failures - Ignore the new user.logout.confirm route in the PasswordPolicyEventSubscriber

Created on 25 June 2024, 5 months ago
Updated 14 August 2024, 3 months ago

Problem/Motivation

At Drupal 10.3 a new confirm logout page was introduced ๐Ÿ› User logout is vulnerable to CSRF Fixed , so any user visting the /user/logout page without a CSRF token will first get a confirmation page.

This page needs to be accessible even if the user needs to reset their password.

Steps to reproduce

Mark the Password Expiration checkbox for a particualr user.

As the user type in the browser's address bar the path: /user/logout and it will force the user to change the password instead of confirm if the user wants to logout.

Proposed resolution

Include the new user.logout.confirm route in the $ignore_route array at the PasswordPolicyEventSubscriber.php file.

๐Ÿ› Bug report
Status

Fixed

Version

4.0

Component

Code

Created by

๐Ÿ‡ฒ๐Ÿ‡ฝMexico gnuget Puebla

Live updates comments and jobs are added and updated live.
  • testing

    Used for Documentation issues related to testing and test development

Sign in to follow issues

Merge Requests

Comments & Activities

Production build 0.71.5 2024