Force redirect back to password form until password got set after one-time-login

Question

When my users click on a one-time-password-reset link then I log them in and then show them a page where they can choose their new password. Problem is that there are two additional links on that page (one for dashboard and some other one) and they can click on them and visit the linked pages.

I want that until they change their password they cannot navigate to other pages. For now I managed to set a custom value in $_SESSION, but I can't figure out how I can intercept their further request (once they land on password change page). How can I check for such a session value and redirect them back to password-reset page (if they haven't changed their password yet) and allow them to navigate to other pages only after they changed their password?

Answer 1

You should be able to use hook_init to check for your custom $_SESSION variable (along with other conditions), and then leverage drupal_goto() to send the user back to the password change page.

Rough example:

function MODULE_NAME_init() {
  // Check that the session key exists.
  if (!empty($_SESSION['my_special_session_key'])) {
    // Check to verify the path the user is currently visiting is not the 
    // password change form, or related path.
    // This needs to be customized according to your needs.
    if (arg(0) != 'user' || arg(1) != $GLOBALS['user']->uid || arg(2) != 'edit') {
      drupal_goto("user/{$GLOBALS['user']->uid}/edit");
    }
  }
}

You'll also need to unset that $_SESSION key after the user successfully changes their password. You'll likely want to do this using another hook related to the password change form.

Usinghook_form_FORM_ID_alter to add a custom submit callback to the form is a reasonable choice.

Here is an example that adds the submit callback to the user's edit form if the $_SESSION key exists.

/**
 * Implements hook_form_FORM_ID_alter().
 */
function MODULE_NAME_form_user_profile_form_alter(&$form, &$form_state) {
  if (!empty($_SESSION['my_special_session_key'])) {
    $form['#submit'][] = '_MODULE_NAME_unset_session_key';
  }
}

/**
 * Custom callback for removing the special session key.
 */
function _MODULE_NAME_unset_session_key() {
  unset($_SESSION['my_special_session_key']);
}

Hope this helps.

Answer 2

I did similar years ago in 7 using rules + roles although obviously you could do it in code too. Once they've done what you want them to do then you assign them a different role, until then they will always get redirected back to the page you want.

I'm only answering from vague memories, so initial thoughts are you may need to store the password hash before and check to ensure it's changed after.