5

My problem with Drupal is that when I choose "Request new password" and submit, it sends me a email with a link

example.com/?q=user/reset/69/1376903015/wiUMZxM27RkYYAAr6zHZfqz6BH4sVMHDAfGoaeZT-Cc

I can login to account by clicking over that link. When I do the same it logged in me and redirects me to user edit page

example.com/?q=user/69/edit&pass-reset-token=-yS11phdH8HuId-5wpaKrdI6KyWOtfV098jZ5mXb_C0

Now I want to reset my password but when I click on password tab example.com/?q=user/69/password, it ask me my account's current password. But I (may be a user) don't know current password . So How can I change password?

One point I noticed that when I put pass-reset-token on the password change URL like this

example.com/?q=user/69/password&pass-reset-token=-yS11phdH8HuId-5wpaKrdI6KyWOtfV098jZ5mXb_C0

I can reset my password without putting current password.

It means that token does not apply on the password tab link. Do I need some module or change in core user module to rectify this problem?

WHAT I DID FOR TIME BEING / TEMPORARY SOLUTION

I edited file : modules/user/user.pages.inc //on line Number 142 updated

drupal_goto('user/' . $user->uid . '/edit', array('query' => array('pass-reset-token' => $token)));

to this

drupal_goto('user/' . $user->uid . '/password', array('query' => array('pass-reset-token' => $token)));

Changed "edit" to "password"

Now my goal is complete. I know it not a good solution.

Any suggestion or answer would be appreciated.

Improve this question
7
  • What version of drupal is this?
    – 4life
    Commented Aug 19, 2013 at 11:31
  • I am using Drupal 7
    – Amit Kumar Sharma
    Commented Aug 19, 2013 at 11:36
  • I found out from status report It's Drupal 7.22 version
    – Amit Kumar Sharma
    Commented Aug 19, 2013 at 11:39
  • Looks like a bug in core, but vanilla core does not have this problem, so... maybe you need to disable some module instead, if something prevents password recovery flow from working? Maybe you have some kind of redirect set up and it removes security token, or overrides login redirect preventing password change page from appearing just after link click?
    – Mołot
    Commented Aug 19, 2013 at 11:52
  • When you are logged-in, a URL like example.com/user/69/password (where 69 is the user ID for your account) just shows you the user profile; when you are not logged-in, a URL like that gives you an access denied error. Definitively, what you describes is not what Drupal core does.
    – avpaderno ♦
    Commented Aug 19, 2013 at 12:26

2 Answers 2

Reset to default
3

No Current Password module allows you to make this field optional.

Also, there's an issue in core about this.

Improve this answer
3
  • 2
    I want user to put current password in case of normal login and edit. But when user login through forgot password link, system should not ask current password.
    – Amit Kumar Sharma
    Commented Aug 20, 2013 at 5:39
  • As stated here: "you need to make sure you log out, and then go to user/password and request the password reset".
    – jonhattan
    Commented Aug 20, 2013 at 8:08
  • Thanks for your response. I had to logout every time when use forgot password.
    – Amit Kumar Sharma
    Commented Aug 20, 2013 at 8:34
0

I edited file : modules/user/user.pages.inc //on line Number 142 updated

drupal_goto('user/' . $user->uid . '/edit', array('query' => array('pass-reset-token' => $token)));

to this

drupal_goto('user/' . $user->uid . '/password', array('query' => array('pass-reset-token' => $token)));

Changed "edit" to "password"

Now my goal is complete.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.