0

I am using drupal 7. I have this functionality that when a user clicks the reset password he gets a one time link on which if he/she clicks then they gets to some page where they can change their password.

But this functionality is somewhat need to be modified. Suppose if they don't click on one link sent to them and then again request forget password, i want to send the same on-time-password-reset link to them and not generate new one untill 24 hours or if they clicks whichever happens first.

So do we have any function which can tell us if there is already existing one-time-password-reset link in database or not and if yes how can we reuse that instead of creating new one.

Also if they clicks on the one-time-forget-password link then they should land on password reset page (it is working as expected), but they should not be able to click any other navigation icon and if they does then message should tell them that they need to reset their password first.

Improve this question

1 Answer 1

Reset to default
0

In D7 one-time reset pw links are generated using the normal hashing techniques (plus a timestamp) but they are not saved in the DB (see user_pass_reset_url). This means that there is no way to resend a link (without doing some major work to store this on your own). I don't see why you would care about resending the identical link, but I'm sure you have your reasons.

If they do click a reset password link, I would recommend that you style the password reset page using a completely different page template that does not include your navigation links (etc...) rather than trying to disable them. Just be sure to add a message with a link to the homepage (or where ever) once they successfully edit their password, or even better, do a redirect upon success.

Improve this answer
6
  • Okay if i remove the navigation links user can go to other pages via browser url. I want to put a check that : If a user clicks on one time password reset link -> he gets logged into the application and lands to a password reset page where some navigation links are available, he can click on them but untill he changes his password he should come back to password reset page.
    – Pawan
    Commented Sep 12, 2018 at 10:00
  • I don't believe there is a way to do this without writing custom code
    – bleen
    Commented Sep 12, 2018 at 18:18
  • Yeah agreed...so, i made a table and then inserted the one-time links on generation and on time of reset i deleted them. But i cannot figure out the second problem....like i don't want users to navigate once they click one-time-password-reset link and goto password reset page.
    – Pawan
    Commented Sep 14, 2018 at 6:33
  • I don't love this functionality, but you could set a session variable when a person lands on a page because of the 1-time link and then intercept every request and check for that session variable. If its there, redirect back to the change-password page and only kill that session var once the pw has been changed
    – bleen
    Commented Sep 14, 2018 at 16:52
  • How can i intercept each request and where would be the best place to check it...any thoughts ?
    – Pawan
    Commented Sep 17, 2018 at 21:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.