search

backdrop-contrib / backdrop-drush-extension

A set of commands and boot class for Drush and Backdrop CMS.
GNU General Public License v2.0
14 stars 18 forks source link

Drush ULI - allow user to change password for user #1 #207

Closed stpaultim closed 4 years ago

stpaultim commented 4 years ago

We just got a comment in the forum about the fact that Drush ULI does not allow the user to change their password after login. https://forum.backdropcms.org/forum/using-drush-uli-reset-admins-password-doesnt-work-correctly#comment-1491

It looks like this MIGHT be intentional or only partially implemented. In this issue: https://github.com/backdrop-contrib/drush/issues/16 @quicksketch makes a comment that suggests that this is how drush uli is expected to work.

For the record, in my quick test today on a Drupal 7 site I was able to use ULI to login and change the admin password. This is the message I get after logging in with Drush ULI:

You have just used your one-time login link. It is no longer necessary to use this link to log in. Please change your password.

The Backdrop CMS message appears to leave off the option of changing password intentionally:

You have used your one-time log-in link and are now logged-in.

This issue has two parts:

1) Did we intentionally decide to NOT support password reset with drush uli? 2) Should there be a drush command that does allow a system admin to reset the password for the site?

If the user has lost control of or does not know the email address for user 1, they might not have any ability to reset the password without direct access to the database. With access to the database they could change the admin email address and submit a change password request.

stpaultim commented 4 years ago

Thanks @serundeputy for clarification.

It would appear that drush upwd is the correct command to update a users password and that in fact drush uli is not supposed to provide this option. It's purpose is only a one time user login link.

Closing this ticket.