repatched core with https://www.drupal.org/node/1754162#comment-9737269
This commit is contained in:
@@ -1088,13 +1088,16 @@ function user_account_form(&$form, &$form_state) {
|
||||
'#description' => t('To change the current user password, enter the new password in both fields.'),
|
||||
);
|
||||
// To skip the current password field, the user must have logged in via a
|
||||
// one-time link and have the token in the URL.
|
||||
$pass_reset = isset($_SESSION['pass_reset_' . $account->uid]) && isset($_GET['pass-reset-token']) && ($_GET['pass-reset-token'] == $_SESSION['pass_reset_' . $account->uid]);
|
||||
// one-time link and have the token in the URL. Store this in $form_state
|
||||
// so it persists even on subsequent Ajax requests.
|
||||
if (!isset($form_state['user_pass_reset'])) {
|
||||
$form_state['user_pass_reset'] = isset($_SESSION['pass_reset_' . $account->uid]) && isset($_GET['pass-reset-token']) && ($_GET['pass-reset-token'] == $_SESSION['pass_reset_' . $account->uid]);
|
||||
}
|
||||
$protected_values = array();
|
||||
$current_pass_description = '';
|
||||
// The user may only change their own password without their current
|
||||
// password if they logged in via a one-time login link.
|
||||
if (!$pass_reset) {
|
||||
if (!$form_state['user_pass_reset']) {
|
||||
$protected_values['mail'] = $form['account']['mail']['#title'];
|
||||
$protected_values['pass'] = t('Password');
|
||||
$request_new = l(t('Request new password'), 'user/password', array('attributes' => array('title' => t('Request new password via e-mail.'))));
|
||||
|
||||
Reference in New Issue
Block a user