[5.x]: actionUrl('users/send-password-reset-email') returns 404

masiorama commented 2 weeks ago

What happened?

Cannot make recovery password form with dedicated craft endpoint work with actionUrl while it does work with actionInput.

Steps to reproduce

Install craft cms via shell, following instructions: composer create-project craftcms/craft my-craft-project
On the template/index page add the form below, which does work (submit form with empty text leads to error message, which is fine):

<form method="post" accept-charset="UTF-8">
  {{ csrfInput() }}
  {{ actionInput('users/send-password-reset-email') }}

  <label for="loginName">Username or email</label>
  {{ input('text', 'loginName', loginName ?? craft.app.user.rememberedUsername, {
    id: 'loginName',
  }) }}

  {% if errors is defined %}
    {{ ul(errors, {class: 'errors'}) }}
  {% endif %}

  <button>Submit</button>
</form>

Remove actionInput for actionUrl, as follows.

<form method="post" accept-charset="UTF-8" action="{{ actionUrl('users/send-password-reset-email') }}">
  {{ csrfInput() }}

  <label for="loginName">Username or email</label>
  {{ input('text', 'loginName', loginName ?? craft.app.user.rememberedUsername, {
    id: 'loginName',
  }) }}

  {% if errors is defined %}
    {{ ul(errors, {class: 'errors'}) }}
  {% endif %}

  <button>Submit</button>
</form>

The latter doesn't work (submit form with empty text leads to 404), or I am missing something huge here.

Expected behavior

The two form above should be equivalent.

Actual behavior

They are not.

Craft CMS version

5

PHP version

8,2

Operating system and version

No response

Database type and version

mysql 8

Image driver and version

No response

Installed plugins and versions

-

brandonkelly commented 2 weeks ago

Guessing that the action is resolving correctly, but Craft just doesn’t know where to redirect the request afterward (which defaults to the requested URL).

Try adding this to the form:

{{ redirectInput('some/path') }}

masiorama commented 2 weeks ago

Hi @brandonkelly thanks for your support. I added the {{ redirectInput('some/path') }} and get 2 different behaviors depending on whether the input field nickname is compiled or not.

the input field is filled with any char -> the form works and the user is redirected to the some/path page.
the input field is blank -> the form keeps returning the same 404 error.

In the second case I would expect to be redirected to the form page with the "input cannot be black" user message .

brandonkelly commented 2 weeks ago

The way this typically works is:

Form is submitted from /some/url and has an empty action="" attribute.
Controller action fails (e.g. due to validation) and sets the invalid user to a route variable. Returns null so Craft knows to continue routing the request based on the requested URL.
The original template is re-rendered (via the requested URL) and passed in the invalid user model, to surface any validation errors on it.

When you submit the form with a different action attribute, there is no normal template route to fall back to when the controller fails. Even if we were to allow you to pass an alternate redirect URL in the case of failure, it still wouldn’t be perfect because you’d end up losing access to the invalid user model in the process.

So in hindsight, setting the controller action via the action form attribute was not a good suggestion on my part (#15041), at least for actions that need to do validation.

Maybe a better solution to #15041 would be to set the action input to the current page’s URL, and still set the action input within the form like you normally would:

<form method="post" accept-charset="UTF-8" action="{{ craft.app.request.absoluteUrl }}">
  {{ csrfInput() }}
  {{ actionInput('users/send-password-reset-email') }}
  ...
</form>