279716 - Users have to relogin when changing their own password

Status: RESOLVED FIXED

(Bugzilla :: User Accounts, defect)

Description

[Alexander Kraus]

User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.0.3705; .NET CLR 1.1.4322)
Build Identifier: 

after changing the own password at the page userprefs.cgi,
the user has to relogin.
If the passwordchange was successful the user gets logged out althoug the code 
in userprefs.cgi shows, that the current logincookie should stay active

Reproducible: Always

Steps to Reproduce:
1.change password
2.go to an other page (for example 'home')
3.the loginpage appears



Expected Results:  
the selected page should be displayed

Comment 1

[Frédéric Buclin]

I can reproduce. userprefs.cgi says:

 # Invalidate all logins except for the current one
 Bugzilla->logout(LOGOUT_KEEP_CURRENT);

The footer is correctly displayed when the "Account Preferences" page is
updated, but as soon as the user tries to access another page, he is being
logged out, despite of LOGOUT_KEEP_CURRENT.

Wurblzap has a nice explanation about this, so I prefer to let him explain it
here. ;)

Comment 2

[Marc Schumann [:Wurblzap]]

Attachment: Patch (2.20 and trunk)

Comment 3

[Frédéric Buclin]

Comment on attachment 190942 [details] [diff] [review]
Patch (2.20 and trunk)

I'm really not the best reviewer you can find about cookies. Maybe kiko?

Comment 4

[Dave Miller [:justdave]]

Does this affect 2.20?

Comment 5

[Teemu Mannermaa (:wicked)]

(In reply to comment #4)
> Does this affect 2.20?

Looks like only 2.16 branch is not affected by this.

Comment 6

[Teemu Mannermaa (:wicked)]

Comment on attachment 190942 [details] [diff] [review]
Patch (2.20 and trunk)

This patch seems to fix reported problem and works on trunk and 2.20 branch. 2.18 branch needs a backport.

Comment 7

[Frédéric Buclin]

2.18 only accepts security fixes, so no need to backport it.

Comment 8

[Frédéric Buclin]

Marc is on vacation till the end of the month, IIRC. Doing the checkin myself.

tip:

Checking in Bugzilla/Auth/Login/WWW/CGI.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/Auth/Login/WWW/CGI.pm,v  <--  CGI.pm
new revision: 1.13; previous revision: 1.12
done

2.20:

Checking in Bugzilla/Auth/Login/WWW/CGI.pm;
/cvsroot/mozilla/webtools/bugzilla/Bugzilla/Auth/Login/WWW/CGI.pm,v  <--  CGI.pm
new revision: 1.12.2.1; previous revision: 1.12
done