how does a user set/reset his password?

collective / dexterity.membrane

enables dexterity content items to be used as users and groups in Plone sites

3 stars 14 forks source link

how does a user set/reset his password? #8

Open seletz opened 11 years ago

seletz commented 11 years ago

When using the example type there's a Membership fieldset which contains the initial password. However, this is visible on creation time only.

How is a user supposed to change his password?

Also, the fieldset is easily missed -- and after a save there's no obvious way to set the password.

seletz commented 11 years ago

BTW, the reset password radio button is not selectable:

site

seletz commented 11 years ago

OK -- it seems that the setting in the dexterity.membrane control panel is the culprit.

If the UUID setting is cleared as below, then users and admins may change the password. Otherwise, the password reset radio button is disabled, and users can't change their own passwords either.

site-1

mauritsvanrees commented 11 years ago

I have not dived into this yet, but two remarks:

Confirmed.
Really weird. Switching uuid on or off should have no effect on this.

mauritsvanrees commented 11 years ago

One problem is that toggling the uuid setting currently changes the user id as reported by the member object, but it changes nothing in the membrane catalog or anything else in acl_users. In fact nothing should be changed, because I think the user id should always stay the same, also when toggling this uuid setting. I added a branch maurits-fixed-user-id which makes sure the user id is set once. That part seems to work, but it does not completely solve the problem. It may not be the best approach.

If someone wants to hack on that branch or a different branch during my vacation, that is fine. :-)

hvelarde commented 11 years ago

@jpgimenez may be we can take a look at this at some point

djowett commented 5 years ago

Obviously https://github.com/collective/dexterity.membrane/blob/master/dexterity/membrane/behavior/password.py#L123 hides the password and confirm_password fields for the EditForm. I presume there is a reason why that is done. Could someone elaborate on why?

mauritsvanrees commented 5 years ago

I am not using this package myself, and I don't remember the details. But I suppose:

Maybe not hiding those fields may show the password in plain text if a wrong field or widget is used.
Setting a password is usually done in a different form. Core Plone with standard members also does not show this field on the form where you edit your member properties. It needs special handling, like maybe invalidating your login cookie. Seems better (or easier code-wise) to do this in a special form.