change user password doesn't fully log you out (but it should)

[oubiwann]

I think we need to force a page refresh after a user changes password...

[oubiwann]

Nevermind -- I see the call to acl_users._doChangeUser() now.

The problem probably comes from using the "private" method _doChangeUser(). I'll see if there's a more complete method that uses the PAS machinery to process a user/password change.

[oubiwann]

The plot thickens...

I originally used the PAS machinery for UserSettings.manage_editUserSettings(), but not for UserSettingsManager.manage_changeUser().

But... I'm not sure that what I did in UserSettings is good, at least, not in the order that it is currently done. If the code works as expected, the user's password will be updated, their credentials will be reset, they will be logged out, and the rest of method will not run.

Some notes:

• It seems that UserSettings.manage_editUserSettings() is only used in skins/zenmodel/editUserSettings.pt
• I cannot find any code in Zenoss that uses UserSettingsManager.manage_changeUser -- am I missing something?

If this is true, then my assessment from the previous comment is incorrect: we are using the PAS machinery and need to do something else in addition. Possible resetting credentials upon password change.

[oubiwann]

Erik, there is another issue with the user management page, and a solution to that could fix the changed password issue.

If I am logged in as a user with a manger role, I see the "assign roles" widget. If I change the roles to be non-manager, the data saves and the page is refreshed, but with the "assign roles" widget still visible.

Not until the next page load does the widget go away, when it should go away after the role is changed.

[oubiwann]

I'm going to open a new ticket for the last comment I posted.

This ticket can be closed now. Here's what I did:

• Moved the password-changing code to the end of the manage_editUserSettings() method (it turned out that the changes weren't getting saved if the password also changed).
• Added a logout() call right after a password change.

Tests confirmed that after a password change, a user is redirected to the login form.

[edahl]

looks good to me.