Password reset link not valid when reset ticket max age is set to eternal

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 6.1.0 CE GA1, 6.1.10 EE GA1
• Fix Version/s: 6.1.1 CE GA2, 6.1.20 EE GA2, --Sprint 11/12, 6.2.0 CE M2
• Component/s: Authentication
• Labels:
  • QA-R
  • eternal
  • password
  • reset
• Environment: Liferay 6.1.0 CE GA1
• Branch Version/s:
  6.1.x
• Backported to Branch:
  Committed
• Similar Issues: Show 4 results ; ;

  LPS-11947	reset-ticket--max-age not translated in Password Policy page - new password policy page
  LPS-32121	Forgot password link doesn't work
  LPS-13263	Password reset link works multiple times when the user has an existing session
  LPS-21704	UserLockoutException when using ticket (reset link) for password recovery and the user account is locked

In the password policies, you can set the reset ticket max age to eternal. This implies that the ticket send to the user for a password reset is always valid. However once a reset is requested, then the reset link send by mail, will not forward the user to the password reset screen and the ticket is removed from the database.

In the file /portal-web/html/potlet/password_policies_admin/edit_password_policy.jsp, the reset max age is set to 0.

This is calculated with in UserLocalServiceImpl class in the sendPassword method:
Date expirationDate = new Date(System.currentTimeMillis() + (passwordPolicy.getResetTicketMaxAge() * 1000)); (line 3222)

The expiration date is set to the current date. The link is send to the user. After clicking it, the link is processed in UpdatePasswordAction class, where the ticket is checked for expiration (line 121) where it will always fail because it is before the current datetime.

[Michael Saechang]

Committed on:
Portal 6.1.x CE GIT ID: a56304b35a9f07795fc259ee0a59294a98ab0ef9.
Portal 6.2.x GIT ID: 17d712db3713217ee9fd7d98b76b63053ae7aca0.

[Sharry Shi]

PASSED Manual Testing using the following steps:

1. Login as admin.
2. Go to Control Panel.
3. Click at Password Policies under Portal.
4. Edit the Default Password Policy, change the Reset Ticket Max Age as Eternal.
5. Setup the Mail in Server Administration.
6. Create a new user with an registed gmail Email Address.
7. Sign out.
8. Click At Forgot Password.
9. Fill the new user's gmail address in the Email Address field,and fill the same number in Text Verification as picture.
10. Change your local time to the future.
11. Login your gmail, check the email from Joe Bloggs.
12. Click the link in your email.

Reproduced on:
Tomcat 7.0 + MySQL 5. Portal 6.2.x GIT ID: 9d36ccf60637ddb1db9cdb449dbc94c18a241f83.

The Password reset link can not navigate to password reset page.

Fixed on:
Tomcat 7.0 + MySQL 5. Portal 6.1.x.CE GIT ID: 7d73bea60eeab31ac1cf4a3270dc0f916ce1fd44.
Tomcat 7.0 + MySQL 5. Portal 6.1.x.EE GIT ID: 94f8f37a1fe7df90fe4603c7e072ffe80f96c05d.
Tomcat 7.0 + MySQL 5. Portal 6.2.x GIT ID: abae10ad2e421868e4e238b9693a783b414091ce.

The Password reset link navigates user to the password reset page.