2

Running EE 2.9.0 and MSM and I am having trouble with the Reset Password function. When I enter my email and click submit I get the following error:

The following errors were encountered

This form has expired. Please refresh and try again.

Return to Previous Page

Here is the code that I am using for the login form and the link to the password reset:

{exp:member:login_form return="{segment_1}/{segment_2}/{segment_3}"}

<p><label>Username</label><br />
<input class="text" type="text" name="username" value="" maxlength="32" class="input" size="25" /></p>

<p><label>Password</label><br />
<input class="text" type="password" name="password" value="" maxlength="32" class="input" size="25" /></p>

<p><input type="checkbox" name="auto_login" value="1"> Auto-login on future visits</p>

<p><input type="submit" name="submit" value="Submit" /></p>

<p><a href="http://www.sitexyz.org/member/forgot_password">Forgot your password?</a></p>
<p>Not registered yet? <a href="http://www.sitexyz.org/member/register">Register Now</a>.</p>

{/exp:member:login_form}

No amount of refreshing makes a difference. This affects users across browsers and locations.

Welcoming all guidance to a solution.

Improve this question
2
  • what template code you use for reset password?
    – Max Lazar
    Commented Oct 28, 2014 at 12:45
  • I added the code to the question above.
    – forrest
    Commented Oct 28, 2014 at 14:35

2 Answers 2

Reset to default
2

You need to include a CSRF token as a hidden field. You can generate one easily enough with

<input type="hidden" name="csrf_token" value="{csrf_token}">

Documentation here

Improve this answer
7
  • Hi foamcow, this makes sense on the login form itself, but the reset password portion is a link to a default password reset form. So it seems that the CSRF input field in the login form would not have an impact in the password reset form.
    – forrest
    Commented Oct 28, 2014 at 16:23
  • It is absolutely necessary. I just had the same problem myself this afternoon and that's the fix for it. The error message you are getting is indicating that the CSRF token is missing/expired. Or do you mean that the template with the actual reset form already HAS the CSRF token and it is generated at the moment it is being used?
    – foamcow
    Commented Oct 28, 2014 at 16:26
  • Let me step back. The above form is a login form, which also has a link to another form in the event that you need to reset your password. Does the CSRF input field in the login form have any impact on the form where you submit your email to initiate the password reset?
    – forrest
    Commented Oct 28, 2014 at 16:46
  • I don't know for sure about whether the login form itself has an impact on the password reset BUT the error you are seeing is coming from the Password reset form and NOT the login form. The Password reset form ALSO needs a CSRF token. So check the reset form for the presence of the CSRF token and if it's not there you need to add the hidden field I suggested. The code you are posting is NOT the form which is generating the error message.
    – foamcow
    Commented Oct 28, 2014 at 17:27
  • When you say "when I enter my email and click submit" are you entering your email on the login form or the password reset form? If it's the login form you will need the CSRF token on there as EE is trying to process the form and can't because you lack a proper token.
    – foamcow
    Commented Oct 28, 2014 at 17:29
-1

I found the solution to my problem. While the link above does indeed go to a password reset request form, the correct link should be:

http://www.sitexyz.org/admin.php?S=0&D=cp&C=login&M=forgotten_password_form
Improve this answer
5
  • Glad you got it working but that's a different form. That links to the control panel's login/reminder form. If you look at the HTML for that form, you'll see it has a CSRF token. You were originally using a member template which was missing the token. EE needs the token to be present to ensure the form isn't being reused or data is being posted from another domain. Did you actually try adding the code I suggested?
    – foamcow
    Commented Oct 30, 2014 at 17:26
  • Not so. While the first form has a link to the reset it is not the problem. I don't know where the other password reset form is from, but it was not one I created and I don't know where it could be edited. I agree that the CSRF token is essential, but getting the link to the correct reset form solved my problem, which is what this is all about. Downgrading the solution is misleading and you will note that I did not downgrade your response, even though it was not the solution to my problem.
    – forrest
    Commented Oct 31, 2014 at 12:53
  • But your 'solution' is solution to a different problem. It gets around the issue you had but it doesn't answer your question as stated. Additionally, the code you posted was a custom login form and not the 'system' password reset form which you are now using as your solution (it's not even a password reset form). Look at the generated HTML of your custom password reset form and you'll see it doesn't contain a CSRF token. By adding one you would solve the problem as stated rather than use a different reset form (which many people would find undesirable).
    – foamcow
    Commented Oct 31, 2014 at 13:36
  • BTW feel free to downgrade my answer if you feel it isn't correct (though I assure you it is). That's how StackExchange is meant to work. Downvote incorrect answers and upvote correct ones (you'll notice my answer already has an upvote).
    – foamcow
    Commented Oct 31, 2014 at 13:37
  • This is not about ups or downs. Your point was perfectly valid. I just had the wrong link to the password reset.
    – forrest
    Commented Oct 31, 2014 at 14:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.