Password reset will not work when public portal is active

Bug #1104070 reported by Marcel van der Boom (HS-Development BV)
22
This bug affects 3 people
Affects Status Importance Assigned to Milestone
Odoo Addons (MOVED TO GITHUB)
Fix Released
Medium
OpenERP R&D Addons Team 1

Bug Description

A password reset request will not work when the public portal is active. This is caused by the automatic login of the anonymous user, thus making any request redirect there and the login form where the password can be confirmed is never shown.

description: updated
Revision history for this message
Marcel van der Boom (HS-Development BV) (mrb) wrote :

Can anyone confirm or reproduce this?

Changed in openobject-addons:
assignee: nobody → OpenERP R&D Addons Team 1 (openerp-dev-addons1)
importance: Undecided → Medium
status: New → Confirmed
Revision history for this message
Nhomar - Vauxoo (nhomar) wrote :

imho IN STABLE the importance is high because no there are any way to reset password in other way..... then if this feature is not working how even __one__ company is starting to use in production V70?

no longer affects: openobject-addons/7.0
no longer affects: openobject-addons/trunk
Revision history for this message
Olivier Dony (Odoo) (odo-openerp) wrote :

The "public portal" module was incorrectly looking for parameters in the query string instead of the URL fragment. A possible workaround is to click on the Back button of the browser after ending up on the public portal.

The fix has landed in addons 7.0 at revision 8755 rev-id: <email address hidden>

Thanks for reporting!

Changed in openobject-addons:
milestone: none → 7.0
Revision history for this message
Marcel van der Boom (HS-Development BV) (mrb) wrote :

Thanks for the fix. However, I think it is only partly fixed.

1. The first part where you click reset password never shows a message that a mail is being sent.

2. Once the mail arrive clicking the link works, but I had to restart my browser for it first, which may be local side-effect. After the restart, things are ok.

Revision history for this message
Olivier Dony (Odoo) (odo-openerp) wrote : Re: [Bug 1104070] Re: Password reset will not work when public portal is active

On 02/25/2013 05:55 PM, Marcel van der Boom (HS-Development BV) wrote:
> 1. The first part where you click reset password never shows a message that
> a mail is being sent.

It works for me: a notification appears on the top right of my browser window,
similarly to the error you see when a mandatory field is missing.
If you don't see it, you should maybe report another bug and be sure to mention
your browser version (and double-check the error console of your browser)

> 2. Once the mail arrive clicking the link works, but I had to restart my
> browser for it first, which may be local side-effect. After the restart,
> things are ok.

Isn't it because you clicked on the reset password link while having an already
open session? The reset links are meant to be clicked by different persons on
different computers. This is usually simulated by clearing the browser cookies
or using your browser's incognito window.

Revision history for this message
Marcel van der Boom (HS-Development BV) (mrb) wrote :

On Mon 25-Feb-2013 17:39
"Olivier Dony \(OpenERP\)" <email address hidden> wrote:

> It works for me: a notification appears on the top right of my
> browser window, similarly to the error you see when a mandatory field
> is missing. If you don't see it, you should maybe report another bug
> and be sure to mention your browser version (and double-check the
> error console of your browser)
>

The notification you refer to is the error 'popup' (in black). That
works fine. I'm refererring to the notification (in red) message that a
mail has been sent. This notification works fine when the public portal
is not active, so I know it works.

--
Marcel van der Boom -- http://hsdev.com/mvdb.vcf
HS-Development BV -- http://www.hsdev.com
We use bitcoin! -- http://bitcoin.org

Revision history for this message
Marcel van der Boom (HS-Development BV) (mrb) wrote :
Revision history for this message
Marcel van der Boom (HS-Development BV) (mrb) wrote :

So, in the attachment in #7, the left never appears when the public portal is active, the right one works as it should be.

During the red msg the uri reads:

'/#action=login&error_message=An+email+has+been+sent+with+credentials+to+reset+your+password'

Revision history for this message
Nhomar - Vauxoo (nhomar) wrote :

Hello.

I think, the workaround help, but for example, i am starting a new imp. I will sen to everybody them reset password mail, as usual, i will need to explain everybody to do back and then dont read nothing just put the new password? i think it can be done better.

A video showing the issue.

THanks for the quick answer oliver, as usual good job, but i think it is incomplete yet.

Regards.

Revision history for this message
Marcel van der Boom (HS-Development BV) (mrb) wrote :

To be clear, I was talking about a reset password request issued by the user *in* the portal itself, not the admin which initiates it from within the administrative interface. I understand the confusion now about the notifications.

Revision history for this message
Olivier Dony (Odoo) (odo-openerp) wrote :

@Marcel, thanks for the screenshot! Yes indeed I was talking about the reset password button for the admin, and you were talking about the login form. And you're right: the reset password option needs to be fixed on the login screen
In fact in has to be much simpler, currently it redirects the user to a different URL which causes all kinds of issues, and not only with the public portal. It should simply perform the action and provide feedback while remaining on the same page (technically, using a background JSON request).
This requires a little bit more work but is necessary, and the fix should be ready soon.

@Nhomar: thanks for the feedback. The workaround I mentioned was only for people who could not update to have the fix. You can simply update to the latest 7.0 and it will fix the main issues you have when clicking on the reset password link. When fixing the second issue that Marcel highlighted we'll also change the label of the button to indicate "Reset password" rather than "Sign up" at this point, and probably hide the other action links. This should help improve the UX (the public portal will not be visible behind the form, this was a consequence of the previous bug). The rest of the login form will still be visible including the "Manage databases" link, I don't think this is a big problem: it's the usual login form people are used to.

Thanks for your patience!

Changed in openobject-addons:
status: Confirmed → In Progress
Revision history for this message
Fabien Meghazi (OpenERP) (fme) wrote :

Fixed for 7.0 in Revision:
8781 revid:<email address hidden>

Changed in openobject-addons:
status: In Progress → Fix Released
Revision history for this message
Marcel van der Boom (HS-Development BV) (mrb) wrote :

The password reset functionality is now working properly! Thanks.

The message sent to the user however, is not translated into the users preferred language. Should I file a new issue on that?

Revision history for this message
vregouby (vregouby) wrote :

I have deactivated the public portal, and my user still doesn't see the enter new password login windows.
Actually, it shows up, then disappears, and my user can never logon since he doesn't have a password...

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.