Bug 22560 - Forgotten password "token expired" page still shows boxes to reset password
Summary: Forgotten password "token expired" page still shows boxes to reset password
Status: RESOLVED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: OPAC (show other bugs)
Version: master
Hardware: All All
: P5 - low normal (vote)
Assignee: Owen Leonard
QA Contact: Tomás Cohen Arazi
URL:
Keywords:
Depends on: 22561
Blocks:
  Show dependency treegraph
 
Reported: 2019-03-21 18:38 UTC by Liz Rea
Modified: 2019-06-06 17:54 UTC (History)
4 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Trivial patch
Who signed the patch off:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 22560: Forgotten password "token expired" page still shows boxes to reset password (2.40 KB, patch)
2019-03-22 13:29 UTC, Owen Leonard
Details | Diff | Splinter Review
Bug 22560: Forgotten password "token expired" page still shows boxes to reset password (2.45 KB, patch)
2019-03-25 14:46 UTC, Liz Rea
Details | Diff | Splinter Review
Bug 22560: Forgotten password "token expired" page still shows boxes to reset password (2.50 KB, patch)
2019-03-25 14:53 UTC, Tomás Cohen Arazi
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Liz Rea 2019-03-21 18:38:05 UTC
To replicate:

Create a user with a username, password, and email defined
Attempt to do a forgotten password recovery
Munge your token link in whatever way you like (?uniqueKey=$2a$08$B9szbC5lwJd.mh.QznRHZu for example - this one should be invalid in your DB)
Note that a yellow "This link is expired" box is shown, but the two password boxes are still there.
Comment 1 Owen Leonard 2019-03-22 13:29:06 UTC
Created attachment 86909 [details] [review]
Bug 22560: Forgotten password "token expired" page still shows boxes to reset password

This patch modifies the OPAC password recovery template so that the new
password entry form doesn't appear if the patron has followed an invalid
or expired link.

This patch also corrects the markup in the page title.

To test, apply the patch and follow the process for resetting a
forgotten password. When you follow the password recovery link, modify
the URL so that the "uniqueKey" parameter is different.

The page should show an error message. The password entry form should
not appear.

Check the page title in the browser's title bar. It should look correct.

https://bugs.koha-community.org/show_bug.cgi?id=22520
Comment 2 Liz Rea 2019-03-25 14:46:13 UTC
Created attachment 86979 [details] [review]
Bug 22560: Forgotten password "token expired" page still shows boxes to reset password

This patch modifies the OPAC password recovery template so that the new
password entry form doesn't appear if the patron has followed an invalid
or expired link.

This patch also corrects the markup in the page title.

To test, apply the patch and follow the process for resetting a
forgotten password. When you follow the password recovery link, modify
the URL so that the "uniqueKey" parameter is different.

The page should show an error message. The password entry form should
not appear.

Check the page title in the browser's title bar. It should look correct.

https://bugs.koha-community.org/show_bug.cgi?id=22520

Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Comment 3 Tomás Cohen Arazi 2019-03-25 14:53:48 UTC
Created attachment 86981 [details] [review]
Bug 22560: Forgotten password "token expired" page still shows boxes to reset password

This patch modifies the OPAC password recovery template so that the new
password entry form doesn't appear if the patron has followed an invalid
or expired link.

This patch also corrects the markup in the page title.

To test, apply the patch and follow the process for resetting a
forgotten password. When you follow the password recovery link, modify
the URL so that the "uniqueKey" parameter is different.

The page should show an error message. The password entry form should
not appear.

Check the page title in the browser's title bar. It should look correct.

https://bugs.koha-community.org/show_bug.cgi?id=22520

Signed-off-by: Liz Rea <wizzyrea@gmail.com>
Signed-off-by: Tomas Cohen Arazi <tomascohen@theke.io>
Comment 4 Nick Clemens 2019-03-28 13:29:54 UTC
Awesome work all!

Pushed to master for 19.05
Comment 5 Martin Renvoize 2019-04-01 10:53:52 UTC
Pushed to 18.11.x for 18.11.05
Comment 6 Lucas Gass 2019-04-01 16:38:26 UTC
backported to 18.05.x for 18.05.12