I'm having trouble with the legal module, version 7.x-1.5.

When a user is sent a one-time login link, using the default user module in Drupal 7.34 the workflow doesn't work properly.

  1. User follows the link to page informing them that they can login & change password.
  2. They are asked to accept the site's Terms & Conditions.
  3. They are redirected to /user/$uid.

If they want to change their password, they can't, because the user module checks for values in the URL query string.

I'm new to Drupal, so I'm looking for a way to either bypass this module for password reset and one-time login links, or to actually redirect to the proper page.

module_invoke_all('user_logout', $user);

// We have to use $GLOBALS to unset a global variable.
$user = drupal_anonymous_user();

$query = NULL;

// Deal with destination from password reset one time login link,
// by creating a new one time login link and setting it as the destination
// after the T&Cs have been accepted.
if (arg(0) == 'user' && arg(1) == 'reset') {
  $token = drupal_hash_base64(drupal_random_bytes(55));
  // This is a new, anonymous-user session.
  $_SESSION['pass_reset_' . $uid] = $token;
  $query = array('destination' => "user/$uid/edit?pass-reset-token=$token");

if (!empty($_REQUEST['destination'])) {
  $query = array('destination' => $_REQUEST['destination']);


$result    = db_select('users', 'u')
  ->condition('uid', $uid)
  ->range(0, 1)
$signatory = array_pop($result);

drupal_goto('legal_accept/' . $signatory->uid . '/' . md5($signatory->name . $signatory->pass . $signatory->login), array('query' => $query));

I tried setting the redirect up properly with an array, like this:

$query = array(
  'destination'        => 'user/$uid/edit',
  'query'              => array(
    'pass-reset-token' => $token,

It doesn't work.

I've been banging my head against this for a while, but I just can't afford to spend anymore time on it right now, so I'm hoping someone has encountered this before and knows how to get around it.

Thanks for your help.

  • I would say this is a problem with the legal module. Please run throught the modules issue queue for similar issues, or if none exists. Post your problem there. Then module mainatainers can attempt to solve this. – Neograph734 Jan 13 '15 at 14:08
  • Yeah, I was just hoping someone had experienced this before and knew how to jigger the two modules to work together in sweet, error-free harmony. I ended up adding this code to the top of the function: if (empty($_POST['form_id']) || $_POST['form_id'] == 'user_pass_reset') { return; } – Paul Kerrigan Jan 15 '15 at 17:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.