4

My problem with Drupal is that when I choose "Request new password" and submit, it sends me a email with a link

example.com/?q=user/reset/69/1376903015/wiUMZxM27RkYYAAr6zHZfqz6BH4sVMHDAfGoaeZT-Cc

I can login to account by clicking over that link. When I do the same it logged in me and redirects me to user edit page

example.com/?q=user/69/edit&pass-reset-token=-yS11phdH8HuId-5wpaKrdI6KyWOtfV098jZ5mXb_C0

Now I want to reset my password but when I click on password tab example.com/?q=user/69/password, it ask me my account's current password. But I (may be a user) don't know current password . So How can I change password?

One point I noticed that when I put pass-reset-token on the password change URL like this

example.com/?q=user/69/password&pass-reset-token=-yS11phdH8HuId-5wpaKrdI6KyWOtfV098jZ5mXb_C0

I can reset my password without putting current password.

It means that token does not apply on the password tab link. Do I need some module or change in core user module to rectify this problem?

WHAT I DID FOR TIME BEING / TEMPORARY SOLUTION

I edited file : modules/user/user.pages.inc //on line Number 142 updated

drupal_goto('user/' . $user->uid . '/edit', array('query' => array('pass-reset-token' => $token)));

to this

drupal_goto('user/' . $user->uid . '/password', array('query' => array('pass-reset-token' => $token)));

Changed "edit" to "password"

Now my goal is complete. I know it not a good solution.

Any suggestion or answer would be appreciated.

  • What version of drupal is this? – 4life Aug 19 '13 at 11:31
  • I am using Drupal 7 – Amit Kumar Sharma Aug 19 '13 at 11:36
  • I found out from status report It's Drupal 7.22 version – Amit Kumar Sharma Aug 19 '13 at 11:39
  • Looks like a bug in core, but vanilla core does not have this problem, so... maybe you need to disable some module instead, if something prevents password recovery flow from working? Maybe you have some kind of redirect set up and it removes security token, or overrides login redirect preventing password change page from appearing just after link click? – Mołot Aug 19 '13 at 11:52
  • When you are logged-in, a URL like example.com/user/69/password (where 69 is the user ID for your account) just shows you the user profile; when you are not logged-in, a URL like that gives you an access denied error. Definitively, what you describes is not what Drupal core does. – kiamlaluno Aug 19 '13 at 12:26
2

No Current Password module allows you to make this field optional.

Also, there's an issue in core about this.

  • 2
    I want user to put current password in case of normal login and edit. But when user login through forgot password link, system should not ask current password. – Amit Kumar Sharma Aug 20 '13 at 5:39
  • As stated here: "you need to make sure you log out, and then go to user/password and request the password reset". – jonhattan Aug 20 '13 at 8:08
  • Thanks for your response. I had to logout every time when use forgot password. – Amit Kumar Sharma Aug 20 '13 at 8:34
0

I edited file : modules/user/user.pages.inc //on line Number 142 updated

drupal_goto('user/' . $user->uid . '/edit', array('query' => array('pass-reset-token' => $token)));

to this

drupal_goto('user/' . $user->uid . '/password', array('query' => array('pass-reset-token' => $token)));

Changed "edit" to "password"

Now my goal is complete.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.