432584 - Password reset form broken

Status: VERIFIED FIXED

(addons.mozilla.org Graveyard :: Public Pages, defect)

Description

[Fred Wenzel [:wenzel]]

The password reset form is broken (on production but on preview as well).

When you enter and submit an email address, you get: "There are errors in this form. Please correct them and resubmit."

It may be related to bug 427974.

Comment 1

[Fred Wenzel [:wenzel]]

Chris, could you take a look at it? If it's related to the CSRF fix, it's probably easy to do.

Comment 2

[Chris Pollett]

Attachment: proposed patch

This was caused by the patch to the CSRF bug which is forbidding any posted data that is not explicitly allowed and which does not have the correct hidden variable. Since users_controller has several methods which need to be run before a session has started these need to be explicitly allowed. The fix makes the process of allowing an action a little easier. Instead of adding new special cases to the app_controller checkCSRF function, one uses the field variable to ones controller $exceptionCSRF which should be an array of allowed paths for this controller. In the case of the bug, this list is now:

"/users/login", "/users/register", "/users/pwreset", "/users/verify"

I looked through users_controller.php and I think this is now a complete list of things that might need to post data before a session starts, but this should be double-checked.

Comment 3

[Reed Loden [:reed]]

Are you saying that /users/verify is currently broken on production, too (besides pwreset)? ... meaning people can't active new accounts? If so, that's really bad.

Comment 4

[Reed Loden [:reed]]

Ah, /users/verify is probably not affected by this because it's a GET instead of POST, right? or am I missing something?

Comment 5

[Fred Wenzel [:wenzel]]

No, I noticed the same. verify is a GET-only action, indeed.

Comment 6

[Fred Wenzel [:wenzel]]

Comment on attachment 319740 [details] [diff] [review]
proposed patch

It works, but please remove users/verify from the list, as it has no POST form.

Comment 7

[Chris Pollett]

checked into r12911, got rid of /users/verify as asked

Comment 8

[Stephen Donner [:stephend] Not actively reading bugmail]

Verified FIXED using: https://preview.addons.mozilla.org/en-US/firefox/users/pwreset