To replicate: Create a user with a username, password, and email defined Attempt to do a forgotten password recovery Munge your token link in whatever way you like (?uniqueKey=$2a$08$B9szbC5lwJd.mh.QznRHZu for example - this one should be invalid in your DB) Note that a yellow "This link is expired" box is shown, but the two password boxes are still there.
Created attachment 86909 [details] [review] Bug 22560: Forgotten password "token expired" page still shows boxes to reset password This patch modifies the OPAC password recovery template so that the new password entry form doesn't appear if the patron has followed an invalid or expired link. This patch also corrects the markup in the page title. To test, apply the patch and follow the process for resetting a forgotten password. When you follow the password recovery link, modify the URL so that the "uniqueKey" parameter is different. The page should show an error message. The password entry form should not appear. Check the page title in the browser's title bar. It should look correct. https://bugs.koha-community.org/show_bug.cgi?id=22520
Created attachment 86979 [details] [review] Bug 22560: Forgotten password "token expired" page still shows boxes to reset password This patch modifies the OPAC password recovery template so that the new password entry form doesn't appear if the patron has followed an invalid or expired link. This patch also corrects the markup in the page title. To test, apply the patch and follow the process for resetting a forgotten password. When you follow the password recovery link, modify the URL so that the "uniqueKey" parameter is different. The page should show an error message. The password entry form should not appear. Check the page title in the browser's title bar. It should look correct. https://bugs.koha-community.org/show_bug.cgi?id=22520 Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Created attachment 86981 [details] [review] Bug 22560: Forgotten password "token expired" page still shows boxes to reset password This patch modifies the OPAC password recovery template so that the new password entry form doesn't appear if the patron has followed an invalid or expired link. This patch also corrects the markup in the page title. To test, apply the patch and follow the process for resetting a forgotten password. When you follow the password recovery link, modify the URL so that the "uniqueKey" parameter is different. The page should show an error message. The password entry form should not appear. Check the page title in the browser's title bar. It should look correct. https://bugs.koha-community.org/show_bug.cgi?id=22520 Signed-off-by: Liz Rea <wizzyrea@gmail.com> Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Awesome work all! Pushed to master for 19.05
Pushed to 18.11.x for 18.11.05
backported to 18.05.x for 18.05.12