Skip to content
Snippets Groups Projects

Issue #3097238: Protect initial login link against abuse

Merge request reports

Loading
Loading

Activity

Filter activity
  • Approvals
  • Assignees & reviewers
  • Comments (from bots)
  • Comments (from users)
  • Commits & branches
  • Edits
  • Labels
  • Lock status
  • Mentions
  • Merge request status
  • Tracking
  • Roderik Muit added 514 commits

    added 514 commits

    • dc0f66eb...88d83002 - 426 commits from branch project:9.2.x
    • 780765a7 - Drupal 9.3.x-dev
    • 7a0988fc - Issue #3211605 by nod_, mherchel: Update Popper.js to version 2.9.2
    • 4214cd75 - Issue #3211606 by nod_, mherchel: Update Tabbable to version 5.2.0
    • d6726045 - Issue #3211888 by mherchel, Gauravmahlawat: Olivero: Layout Builder 33/34/33 layout broken in IE11
    • e939dbe6 - Issue #3209456 by kpa, piggito, mherchel: Update Underscore.js to the latest version (1.13.1)
    • e0d87b69 - Issue #3211602 by mherchel, nod_, andypost: Update jQuery Form to 4.3.0
    • 61a07efc - Issue #3185165 by Spokje, vipin.mittal18, Suresh Prabhu Parkala, lauriii,...
    • 0bff06df - Issue #3189680 by mondrake, daffie, alexpott: Deprecate the 'throw_exception'...
    • 27070f4c - Issue #3100386 by tedbow, ravi.shankar, phenaproxima, nikitagupta,...
    • 0e5db56e - Issue #2902548 by guilhermevp, mfernea, Spokje, quietone, longwave: Fix...
    • e7d67e91 - Issue #3211805 by xjm, Kristen Pol, longwave: Update composer/composer dev...
    • e9a53cb2 - Issue #3143096 by jedihe, jyotimishra123, shetpooja04, alexpott, mradcliffe:...
    • 8dccf4b3 - Revert "Issue #3143096 by jedihe, jyotimishra123, shetpooja04, alexpott,...
    • bd2a1eab - Issue #3206932 by Matroskeen, quietone, alexpott: Rename targetEntityType...
    • c5e16af1 - Issue #3048423 by claudiu.cristea, longwave, klausi: Convert...
    • 525c3d95 - Issue #3211164 by alexpott, catch: Random errors in Javascript Testing
    • de89108c - Issue #3211866 by mondrake, daffie: Upsert::execute() return values are inconsistent
    • a3c114e6 - Issue #3143096 by jedihe, phenaproxima, jyotimishra123, shetpooja04, alexpott,...
    • 38ebeed9 - Issue #3212177 by alexpott, lauriii: Update caniuse-lite as it is outdated
    • 09c38b44 - Issue #3211810 by alexpott, xjm, Spokje, Amber Himes Matz, Kristen Pol,...
    • b48ad909 - Issue #3179734 by zrpnr, bnjmnm, lauriii: Refactor uses of the :tabbable selector and deprecate it
    • a3ca88eb - Issue #2882276 by benjifisher, estoyausente, nuez, kristiaanvandeneynde,...
    • f09730b5 - Issue #3212521 by Spokje, longwave: cspell dislikes identifer in...
    • abec240b - Issue #3212281 by Sakthivel M, tushar_sachdeva, chetanbharambe: Paragraph...
    • 8f711d9d - Issue #3153265 by kiran.kadam911, hinal05, komalk, mherchel, kishor_kolekar,...
    • 9d05a12a - Issue #3211897 by mherchel, Gauravmahlawat: Olivero: On mobile width, submenu...
    • fac878ce - Issue #3191725 by mherchel, kostyashupenko, Kristen Pol, andy-blum, lauriii,...
    • 11af82a6 - Issue #3190120 by mherchel, KapilV, pragati_kanade, djsagar, andy-blum,...
    • 5c952d4a - Issue #3212539 by n4r3n, Wim Leers: Map all Link module's fieldformatters from D7 to D8/D9
    • ebf0c951 - Issue #3212354 by guilhermevp, Chi: AggregatorFeedBlock::build must always return array
    • 011f0e9e - Issue #3211474 by longwave, daffie:...
    • 37cb5dda - Issue #3211480 by longwave, daffie:...
    • d59f8588 - Issue #3207456 by Spokje, longwave, alexpott: Drupal 9 is dependent on symfony/mime directly
    • 95edf33a - Issue #3212034 by longwave, quietone: Account emails are missing newlines due to malformed YAML
    • 08a9dcb2 - Issue #3212998 by mherchel, Gauravmahlawat: Olivero: Normalize JavaScript...
    • 62e06d8c - Issue #2938803 by David_Rothstein, spitzialist, vsujeetkumar, yepa, harsha012,...
    • a35df16d - Issue #3211780 by mondrake, daffie: Deprecate Connection::queryTemporary()
    • 84a6dadd - Issue #3145563 by Charlie ChX Negyesi, NigelCunningham, alexpott, joachim,...
    • cf806905 - Issue #2608750 by phenaproxima, shriaas2898, KapilV, mohit_aghera, RenatoG,...
    • 2e9d4787 - Revert "Issue #2608750 by phenaproxima, shriaas2898, KapilV, mohit_aghera,...
    • 3eebb1b1 - Issue #2608750 by phenaproxima, shriaas2898, KapilV, mohit_aghera, RenatoG,...
    • 720de231 - Issue #3191649 by mherchel, bnjmnm: Update Sortable to 1.13.0
    • b9a52da4 - Issue #3212704 by Gauravmahlawat, mherchel: Olivero: content below region...
    • c6adb7c7 - Issue #2730631 by jibran, benjifisher, claudiu.cristea, pdenooijer, merauluka,...
    • 9db6d56a - Issue #3211599 by Spokje, Wim Leers, lauriii, zrpnr, cilefen: Update CKEditor to version 4.16.0
    • a9560b32 - Issue #2974128 by Majdi, quietone: Missing parameter in process plugin DefaultValue example
    • 2690c63d - Issue #3211936 by alexpott, daffie: Race condition when generating sub directories for image styles
    • 4731e3c6 - Issue #588438 by dww: FormTest::testRequiredFields() fails to drupal_render()...
    • 79dd8321 - Issue #3041885 by tedbow, beautifulmind, dww, ayushmishra206, phenaproxima,...
    • 1ab0f484 - Issue #2868258 by joegraduate, Lendude, Jons, dawehner, alexpott, larowlan:...
    • 39110888 - Issue #3210888 by longwave: Undefined static method Drupal\Core\Database\Connection::serialize()
    • 07905362 - Issue #3163487 by sudiptadas19, IT-Cru, raman.b, idebr, dawehner: Breadcrumb:...
    • 50b89413 - Issue #3212547 by Spokje, quietone, alexpott, longwave: cspell Dictionaries...
    • 0ed127e8 - Issue #3211601 by bnjmnm, nod_, zrpnr, lauriii: Update jQuery to version 3.6.0
    • c2103890 - Issue #3210913 by quietone, Wim Leers, paulocs: DbDumpCommand fails when data...
    • 996b3578 - Issue #3210372 by pfrenssen, claudiu.cristea: Fatal error when passing...
    • d8bba172 - Issue #3190820 by pavnish, WalkingDexter, ayushmishra206, durgeshs, daffie:...
    • 35c43b54 - Issue #3025727 by Krzysztof Domański, Matroskeen, alexpott: Using a data...
    • d4726b18 - Issue #3213638 by bpstr: Fix incorrect Migration plugin description
    • e821dc58 - Issue #3160307 by Hardik_Patel_12, jungle, Kristen Pol, larowlan, catch:...
    • ba7c2c58 - Issue #3212005 by guilhermevp, tedbow, phenaproxima: Add @throws docs to...
    • af458de2 - Issue #3191061 by jcisio, quietone: Remove todo in class Drupal\Core\Routing\RequestContext
    • bf132da9 - Issue #3207405 by Nikhil Banait, Gauravmahlawat, Abhijith S: Add 'Reset'...
    • db54bf04 - Issue #3132778 by kim.pepper, quietone, jungle, daffie: Replace usages of...
    • eddba9a3 - Issue #3193189 by quietone, jibran: Get only translations for localized...
    • 16ba314e - Issue #2742997 by andypost, wizonesolutions, erozqba, naveenvalecha, johanv,...
    • 3ccf8445 - Issue #3208000 by Gauravmahlawat, mherchel: remove toolbar.html.twig template as #3174422 is fixed
    • 35021980 - Issue #2909369 by Spokje, alexpott, longwave, mfernea: Fix...
    • f5d9fec8 - Issue #3123070 by Spokje, msuthars, quietone, longwave, jungle: Fix...
    • baa711c9 - Issue #3107130 by PCate, kishor_kolekar, ravi.shankar, Vidushi Mehta,...
    • 58fb7f8d - Issue #3176361 by alexpott, naresh_bavaskar, longwave: Remove semi-colon from...
    • 573e752f - Issue #3209628 by longwave, rachel_norfolk, antiorario, phenaproxima,...
    • d2647ca5 - Issue #3213022 by andypost, jhodgdon: When generating link to non-existent...
    • b50a4ddb - Issue #3184527 by webflo: Reduce cache variations in locale cache
    • 85ee5e16 - Issue #3209618 by catch, longwave, Neslee Canil Pinto, daffie, andypost, Gábor...
    • a9fbf270 - Issue #3214234 by alexpott: Add core/class_aliases.php
    • b9f132b7 - Issue #2969190 by manish.upadhyay, ranjith_kumar_k_u, Neslee Canil Pinto,...
    • a6124cc0 - Issue #3190815 by Wim Leers, quietone, NickDickinsonWilde, benjifisher,...
    • 201212c8 - Issue #3177660 by mondrake, andypost, anmolgoyal74, daffie, alexpott: Remove...
    • 36353733 - Issue #3210632 by Spokje, longwave, daffie: Update dependencies for Drupal 9.2
    • 3379d012 - Issue #3210633 by Spokje, bnjmnm, longwave, zrpnr: Update JavaScript dependencies for Drupal 9.2
    • a4715517 - Issue #3214308 by longwave, alexpott: Merge class_aliases.php into bootstrap.inc
    • 13c58551 - Issue #3211838 by mondrake, longwave: Convert assertions involving use of...
    • 6802ea33 - Issue #3207968 by quietone, longwave, Spokje: Replace @codingStandards...
    • 1c94be4a - Issue #3126747 by phenaproxima, tim.plunkett, TR, Spokje:...
    • 8db131bd - Issue #3214412 by bnjmnm, tedbow: Build + prettier not run after yarn dependency update 3210633
    • 3962f143 - Merge remote-tracking branch 'refs/remotes/origin/9.3.x' into 3097238-protect-initial-login
    • 02b9054f - Change deprecation comment.

    Compare with previous version

  • Roderik Muit added 3 commits

    added 3 commits

    Compare with previous version

  • Roderik Muit added 1 commit

    added 1 commit

    Compare with previous version

  • Roderik Muit changed the description

    changed the description

  • Roderik Muit changed target branch from 9.2.x to 9.3.x

    changed target branch from 9.2.x to 9.3.x

49 54 $this->submitForm($edit, 'Create new account');
50 55 $this->assertSession()->pageTextContains('A welcome message with further instructions has been sent to your email address.');
51 56
52 /** @var EntityStorageInterface $storage */
57 /** @var \Drupal\Core\Entity\EntityStorageInterface $storage */
  • Bhanu D added 3075 commits

    added 3075 commits

    • 4c5b538e...b7e8bd49 - 606 commits from branch project:9.3.x
    • b7e8bd49...680039ff - 2459 earlier commits
    • d80291c2 - Issue #3326455 by el7cosmos, lauriii, joshuami, zenimagine, Wim Leers,...
    • fb6023c3 - Issue #3370989 by lauriii, Wim Leers: Update CKEditor 5 to 38.1.0
    • b46d0ee3 - Issue #3365945 by larowlan, sakthi_dev, daffie, JvE, eelkeblok, borisson_:...
    • 29d21a77 - Issue #3304246 by smustgrave, dhirendra.mishra, gawalin: string' is a reserved...
    • 5067812f - Issue #3368880 by kim.pepper, longwave: Deprecate file.field.inc and move functions to file.module
    • b6b1fb1e - Issue #3178225 by Liam Morland, FMB, smustgrave, joachim: Make @todo for...
    • 4077f20c - Issue #2953566 by vijaycs85, tstoeckler, mrweiner, robertom, mohit1604,...
    • d4b4f2d3 - Issue #3327659 by klimp: Fix limit value in Explode process plugin documentation
    • 97d1eb06 - Revert "Issue #3365945 by larowlan, sakthi_dev, daffie, JvE, eelkeblok,...
    • 33d265a5 - Issue #3097238: Protect initial login link against abuse and username leaking

    Compare with previous version

  • Lee Rowlands changed target branch from 9.3.x to 11.x

    changed target branch from 9.3.x to 11.x

  • Bhanu D added 1 commit

    added 1 commit

    Compare with previous version

  • Pierre Rudloff added 3539 commits

    added 3539 commits

    Compare with previous version

  • added 1 commit

    • 668e5261 - We don't need to ignore these error anymore

    Compare with previous version

  • Pierre Rudloff added 98 commits

    added 98 commits

    Compare with previous version

  • Pierre Rudloff added 56 commits

    added 56 commits

    Compare with previous version

  • Pierre Rudloff added 75 commits

    added 75 commits

    Compare with previous version

  • 40 39 * The current timestamp.
    41 40 * @param string $hash
    42 41 * Login link hash.
    43 42 */
    44 43 public function buildForm(array $form, FormStateInterface $form_state, ?AccountInterface $user = NULL, $expiration_date = NULL, $timestamp = NULL, $hash = NULL) {
    44 // @todo Remove if clause / else block in Drupal 11.0.0. (We are allowed to
    45 // assume variables are populated, even though we're disallowed from
    46 // making them mandatory in this method definition.)
    45 47 if ($expiration_date) {
    46 48 $form['message'] = ['#markup' => $this->t('<p>This is a one-time login for %user_name and will expire on %expiration_date.</p><p>Click on this button to log in to the site and change your password.</p>', ['%user_name' => $user->getAccountName(), '%expiration_date' => $expiration_date])];
    47 $form['#title'] = $this->t('Reset password');
    49 $form['#title'] = $user->getLastLoginTime() ? $this->t('Reset password') : $this->t('Set password');
    48 50 }
    49 51 else {
    50 // No expiration for first time login.
    52 @trigger_error('The expiration date argument to UserPasswordResetForm::buildForm() is mandatory / not passing it is deprecated in drupal:10.1.0 and is removed from drupal:11.0.0. See https://www.drupal.org/node/3214529', E_USER_DEPRECATED);
    • Will now have to be deprecated in 11.3 and removed in 12

    • Suggested change
      Applied
      52 @trigger_error('The expiration date argument to UserPasswordResetForm::buildForm() is mandatory / not passing it is deprecated in drupal:10.1.0 and is removed from drupal:11.0.0. See https://www.drupal.org/node/3214529', E_USER_DEPRECATED);
      52 @trigger_error('The expiration date argument to UserPasswordResetForm::buildForm() is mandatory / not passing it is deprecated in drupal:11.3.0 and is removed from drupal:12.0.0. See https://www.drupal.org/node/3214529', E_USER_DEPRECATED);
    • Pierre Rudloff changed this line in version 16 of the diff

      changed this line in version 16 of the diff

    • Please register or sign in to reply
  • 34 34 * @param \Drupal\Core\Session\AccountInterface $user
    35 35 * User requesting reset.
    36 36 * @param string $expiration_date
    37 * Formatted expiration date for the login link, or NULL if the link does
    38 * not expire.
    37 * Formatted expiration date for the login link.
    39 38 * @param int $timestamp
    40 39 * The current timestamp.
    41 40 * @param string $hash
    42 41 * Login link hash.
    43 42 */
    44 43 public function buildForm(array $form, FormStateInterface $form_state, ?AccountInterface $user = NULL, $expiration_date = NULL, $timestamp = NULL, $hash = NULL) {
    44 // @todo Remove if clause / else block in Drupal 11.0.0. (We are allowed to
  • 80 80 * \Drupal\Component\Render\FormattableMarkup unless you cast the object to
    81 81 * a string. If left blank, a default message will be displayed.
    82 82 */
    83 protected function assertMailString($field_name, $string, $email_depth, $message = '') {
    83 protected function assertMailString($field_name, $string, $email_depth, $message = ''): void {
  • 119 119 * \Drupal\Component\Render\FormattableMarkup unless you cast the object to
    120 120 * a string. If left blank, a default message will be displayed.
    121 121 */
    122 protected function assertMailPattern($field_name, $regex, $message = '') {
    122 protected function assertMailPattern($field_name, $regex, $message = ''): void {
  • Stephen Mustgrave left review comments

    left review comments

  • Pierre Rudloff added 1 commit

    added 1 commit

    • 9e703268 - Remove out of scope type change

    Compare with previous version

  • Pierre Rudloff added 1 commit

    added 1 commit

    • bf9eb086 - Apply 1 suggestion(s) to 1 file(s)

    Compare with previous version

  • Pierre Rudloff added 1 commit

    added 1 commit

    • ecd53612 - Ignore phpstan errors for now

    Compare with previous version

  • Please register or sign in to reply
    Loading