[#29576] - Require Reset logout
- New
- Medium
- Build: master
- # 29576
Steps to reproduce the issue
- Set one user to require/reset in administrator mode
- Login with the user to reset password
- Not do nothing, just try logout
- The user can't logout
Expected result
The user be able to logout
Actual result
The user can´t logout until reset password
System information (as much as possible)
Joomla Version 3.8+
PHP 7.1 +
PHP 7.2 +
PHP 7.3 +
PHP 7.4 +
Additional comments
I solved the problem editing the file libraries/src/Application/SiteApplication.php
change the line 230 in version 3.9.19
$this->checkUserRequireReset('com_users', 'profile', 'edit', 'com_users/profile.save,com_users/profile.apply,com_users/user.logout');
for
$this->checkUserRequireReset('com_users', 'profile', 'edit', 'com_users/profile.save,com_users/profile.apply,com_users/user.logout,com_users/user.menulogout');
joomla-cms-bot
- 
Based on code review, user can logout, just not when using Logout menu item type in com_users. Must have been an oversight when menu item was added. So the fix should be valid.
@zero-24 Same question to you: Is there any security reason that a user who logged in for a password reset can't log out anymore until having done the reset?
I'm not aware of any but that feature was initial developed by Michael and IIRC uses an whitelist of pages that are still allowed. I personally would argue that when you logged in and you are required to reset your PR you should change it than.
So is this a won't fix?
Looks more like a bug looking at the provided source line (and fix)
$this->checkUserRequireReset('com_users', 'profile', 'edit', 'com_users/profile.save,com_users/profile.apply,com_users/user.logout');
if I understand it correctly the last entry would mean logout is allowed.
@richard67 i prefer someone else do it
| Status | New | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2020-07-29 17:42:59 |
| Closed_By | ⇒ | Quy |
| Status | Closed | ⇒ | New |
| Closed_Date | 2020-07-29 17:42:59 | ⇒ | |
| Closed_By | Quy | ⇒ |
Thank you for raising this issue.
Joomla 3 is now in security only mode with no further bug fixes or new features.
This issue is still relevant for Joomla 4 BUT the fix etc here is not suitable for Joomla 4
Hackwar
- | Labels |
Added:
No Code Attached Yet
bug
Removed: ? |
||
@SniperSister Is there any security reason that a user who logged in for a password reset can't log out anymore until having done the reset?