[Solved (more or less)] Always logged in after a password reset?

marclava · September 30, 2021, 6:21pm

The last option in /@@security-controlpanel is:

Login user after password reset After successful password reset the user will be logged in automatically.

Even when this option is unchecked (set to False), a user stays logged in after a successful password reset. (using the /@@login-help form).

Actually, according to the _reset_password handler the user should not have been logged in (via a call to _auto_login) ...

Can someone try and confirm? I use Plone 5.2.5. Thanks.

github.com

plone/Products.CMFPlone/blob/1565ab310a49ab9c3c0a9459d9861fbceb1919e2/Products/CMFPlone/browser/login/password_reset.py#L144

    
      
              password = self.request.form.get('password')
              try:
                  pw_tool.resetPassword(userid, randomstring, password)
              except ExpiredRequestError:
                  return self.expired()
              except InvalidRequestError:
                  return self.invalid()
              except RuntimeError:
                  return self.invalid()
              registry = getUtility(IRegistry)
              if registry.get('plone.autologin_after_password_reset', False):
                  return self._auto_login(userid, password)
              return self.finish()
          
          
def __call__(self):
              if self.subpath:
                  # Try traverse subpath first:
                  randomstring = self.subpath[0]
              else:
                  randomstring = self.request.get('key', None)

marclava · October 5, 2021, 4:42pm

In my policy addon I monkey-patched Products.CMFPlone.browser.login.password_reset.PasswordResetView._reset_password
In my replacement function, after password reset I redirect to a simple logout view.

Automatic logout is required for my use case: I use a separate Plone instance to reset LDAP passwords, because the main web site does not have write access to the LDAP server.

Still, by design it seems that Plone should be logging off the user after a password reset.

dieter · October 5, 2021, 6:30pm

Why? I find it natural that the user remains logged in; he can explicitly log out if this is what he wants.

marclava · October 5, 2021, 6:47pm

I meant "logging off"...

I get your point, but why there's an option that doesn't work? Look at the code; the intention is to auto-logon only if the option is checked (it is checked by default). It looks like a bug to me; maybe it was never detected because most site admins don't uncheck the option.