1

When users try to reset their passwords clicking on Reset your password, they are fine until they click on the Log in button that shows a message similar to the following one.

This is a one-time login for foobar and will expire on Tue, 20/09/2016 - 15:25. Click on this button to log in to the site and change your password. This login can be used only once.

When users click on the log in button, they get a 404 error, for a page whose URL is similar to http://example.com/user/reset/123/1474293937/ukVdmEMWoYablzZHPYJzMa30-p_skkDv06d564V1KHQ/admin.

Users are logged in and they edit their account to change password. I don't like that users get a 404 error page, which could confuse them.

Why do users see a 404 error?

Improve this question

1 Answer 1

Reset to default
1

Something is intercepting the submission to the user password reset form.

The form should post to the user.reset.login route (/user/reset/{uid}/{timestamp}/{hash}/login), handled by UserController::resetPass(), then redirect to /user/{uid}/edit?pass-reset-token={TOKEN}.

This could be a number of different things which you'll have to troubleshoot (e.g. Rules performing some redirect logic on login, an altered form submit handler, Apache redirect, a module performing some redirect logic on a subscribed event, etc.).

Given that the destination URL is essentially appending "/admin" to password reset form URL that should probably clue you in on what is causing the problem.

Improve this answer
1
  • thanks @Shawn Conn - I found that there was a module implementing hook_user_login() to redirect the user to the /admin route instead of the user's profile (it's a site which only has admin level Drupal users). I've added some logic to prevent this happening when the login is the result of a password reset email.
    – user34185
    Commented Sep 20, 2016 at 9:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.