From 3047f785d569588cdf88a2efc88efab8cfd898c8 Mon Sep 17 00:00:00 2001
From: "stefan.r" <stefan.r@551886.no-reply.drupal.org>
Date: Tue, 6 Jun 2017 13:08:17 +0200
Subject: [PATCH] Issue #1858486 by idebr, David_Rothstein, trawekp,
joseph.olstad, MrHaroldA, jhedstrom: Ajax call breaks Password Reset
---
modules/user/user.module | 9 ++++---
modules/user/user.test | 56 ++++++++++++++++++++++++++++++++++++++++
2 files changed, 62 insertions(+), 3 deletions(-)
diff --git a/modules/user/user.module b/modules/user/user.module
index b818d79ab57f..12ca2800999b 100644
--- a/modules/user/user.module
+++ b/modules/user/user.module
@@ -1088,13 +1088,16 @@ function user_account_form(&$form, &$form_state) {
'#description' => t('To change the current user password, enter the new password in both fields.'),
);
// To skip the current password field, the user must have logged in via a
- // one-time link and have the token in the URL.
- $pass_reset = isset($_SESSION['pass_reset_' . $account->uid]) && isset($_GET['pass-reset-token']) && ($_GET['pass-reset-token'] == $_SESSION['pass_reset_' . $account->uid]);
+ // one-time link and have the token in the URL. Store this in $form_state
+ // so it persists even on subsequent Ajax requests.
+ if (!isset($form_state['user_pass_reset'])) {
+ $form_state['user_pass_reset'] = isset($_SESSION['pass_reset_' . $account->uid]) && isset($_GET['pass-reset-token']) && ($_GET['pass-reset-token'] == $_SESSION['pass_reset_' . $account->uid]);
+ }
$protected_values = array();
$current_pass_description = '';
// The user may only change their own password without their current
// password if they logged in via a one-time login link.
- if (!$pass_reset) {
+ if (!$form_state['user_pass_reset']) {
$protected_values['mail'] = $form['account']['mail']['#title'];
$protected_values['pass'] = t('Password');
$request_new = l(t('Request new password'), 'user/password', array('attributes' => array('title' => t('Request new password via e-mail.'))));
diff --git a/modules/user/user.test b/modules/user/user.test
index 8500bad3a4b7..0875e0ac7927 100644
--- a/modules/user/user.test
+++ b/modules/user/user.test
@@ -465,6 +465,19 @@ class UserPasswordResetTestCase extends DrupalWebTestCase {
);
}
+ /**
+ * Retrieves password reset email and extracts the login link.
+ */
+ public function getResetURL() {
+ // Assume the most recent email.
+ $_emails = $this->drupalGetMails();
+ $email = end($_emails);
+ $urls = array();
+ preg_match('#.+user/reset/.+#', $email['body'], $urls);
+
+ return $urls[0];
+ }
+
/**
* Tests password reset functionality.
*/
@@ -478,6 +491,49 @@ class UserPasswordResetTestCase extends DrupalWebTestCase {
$this->drupalPost('user/password', $edit, t('E-mail new password'));
// Confirm the password reset.
$this->assertText(t('Further instructions have been sent to your e-mail address.'), 'Password reset instructions mailed message displayed.');
+
+ // Create an image field to enable an Ajax request on the user profile page.
+ $field = array(
+ 'field_name' => 'field_avatar',
+ 'type' => 'image',
+ 'settings' => array(),
+ 'cardinality' => 1,
+ );
+ field_create_field($field);
+
+ $instance = array(
+ 'field_name' => $field['field_name'],
+ 'entity_type' => 'user',
+ 'label' => 'Avatar',
+ 'bundle' => 'user',
+ 'required' => FALSE,
+ 'settings' => array(),
+ 'widget' => array(
+ 'type' => 'image_image',
+ 'settings' => array(),
+ ),
+ );
+ field_create_instance($instance);
+
+ $resetURL = $this->getResetURL();
+ $this->drupalGet($resetURL);
+
+ // Check successful login.
+ $this->drupalPost(NULL, NULL, t('Log in'));
+
+ // Make sure the Ajax request from uploading a file does not invalidate the
+ // reset token.
+ $image = current($this->drupalGetTestFiles('image'));
+ $edit = array(
+ 'files[field_avatar_und_0]' => drupal_realpath($image->uri),
+ );
+ $this->drupalPostAJAX(NULL, $edit, 'field_avatar_und_0_upload_button');
+
+ // Change the forgotten password.
+ $password = user_password();
+ $edit = array('pass[pass1]' => $password, 'pass[pass2]' => $password);
+ $this->drupalPost(NULL, $edit, t('Save'));
+ $this->assertText(t('The changes have been saved.'), 'Forgotten password changed.');
}
/**
--
GitLab