2

Running EE 2.9.0 and MSM and I am having trouble with the Reset Password function. When I enter my email and click submit I get the following error:

The following errors were encountered

This form has expired. Please refresh and try again.

Return to Previous Page

Here is the code that I am using for the login form and the link to the password reset:

{exp:member:login_form return="{segment_1}/{segment_2}/{segment_3}"}

<p><label>Username</label><br />
<input class="text" type="text" name="username" value="" maxlength="32" class="input" size="25" /></p>

<p><label>Password</label><br />
<input class="text" type="password" name="password" value="" maxlength="32" class="input" size="25" /></p>

<p><input type="checkbox" name="auto_login" value="1"> Auto-login on future visits</p>

<p><input type="submit" name="submit" value="Submit" /></p>

<p><a href="http://www.sitexyz.org/member/forgot_password">Forgot your password?</a></p>
<p>Not registered yet? <a href="http://www.sitexyz.org/member/register">Register Now</a>.</p>

{/exp:member:login_form}

No amount of refreshing makes a difference. This affects users across browsers and locations.

Welcoming all guidance to a solution.

  • what template code you use for reset password? – Max Lazar Oct 28 '14 at 12:45
  • I added the code to the question above. – forrest Oct 28 '14 at 14:35
2

You need to include a CSRF token as a hidden field. You can generate one easily enough with

<input type="hidden" name="csrf_token" value="{csrf_token}">

Documentation here

| improve this answer | |
  • Hi foamcow, this makes sense on the login form itself, but the reset password portion is a link to a default password reset form. So it seems that the CSRF input field in the login form would not have an impact in the password reset form. – forrest Oct 28 '14 at 16:23
  • It is absolutely necessary. I just had the same problem myself this afternoon and that's the fix for it. The error message you are getting is indicating that the CSRF token is missing/expired. Or do you mean that the template with the actual reset form already HAS the CSRF token and it is generated at the moment it is being used? – foamcow Oct 28 '14 at 16:26
  • Let me step back. The above form is a login form, which also has a link to another form in the event that you need to reset your password. Does the CSRF input field in the login form have any impact on the form where you submit your email to initiate the password reset? – forrest Oct 28 '14 at 16:46
  • I don't know for sure about whether the login form itself has an impact on the password reset BUT the error you are seeing is coming from the Password reset form and NOT the login form. The Password reset form ALSO needs a CSRF token. So check the reset form for the presence of the CSRF token and if it's not there you need to add the hidden field I suggested. The code you are posting is NOT the form which is generating the error message. – foamcow Oct 28 '14 at 17:27
  • When you say "when I enter my email and click submit" are you entering your email on the login form or the password reset form? If it's the login form you will need the CSRF token on there as EE is trying to process the form and can't because you lack a proper token. – foamcow Oct 28 '14 at 17:29
-1

I found the solution to my problem. While the link above does indeed go to a password reset request form, the correct link should be:

http://www.sitexyz.org/admin.php?S=0&D=cp&C=login&M=forgotten_password_form
| improve this answer | |
  • Glad you got it working but that's a different form. That links to the control panel's login/reminder form. If you look at the HTML for that form, you'll see it has a CSRF token. You were originally using a member template which was missing the token. EE needs the token to be present to ensure the form isn't being reused or data is being posted from another domain. Did you actually try adding the code I suggested? – foamcow Oct 30 '14 at 17:26
  • Not so. While the first form has a link to the reset it is not the problem. I don't know where the other password reset form is from, but it was not one I created and I don't know where it could be edited. I agree that the CSRF token is essential, but getting the link to the correct reset form solved my problem, which is what this is all about. Downgrading the solution is misleading and you will note that I did not downgrade your response, even though it was not the solution to my problem. – forrest Oct 31 '14 at 12:53
  • But your 'solution' is solution to a different problem. It gets around the issue you had but it doesn't answer your question as stated. Additionally, the code you posted was a custom login form and not the 'system' password reset form which you are now using as your solution (it's not even a password reset form). Look at the generated HTML of your custom password reset form and you'll see it doesn't contain a CSRF token. By adding one you would solve the problem as stated rather than use a different reset form (which many people would find undesirable). – foamcow Oct 31 '14 at 13:36
  • BTW feel free to downgrade my answer if you feel it isn't correct (though I assure you it is). That's how StackExchange is meant to work. Downvote incorrect answers and upvote correct ones (you'll notice my answer already has an upvote). – foamcow Oct 31 '14 at 13:37
  • This is not about ups or downs. Your point was perfectly valid. I just had the wrong link to the password reset. – forrest Oct 31 '14 at 14:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.