joomla/joomla-cms — pull request #3845 by maxvalentini77 (2014-06-30 13:49:40+00:00)
Title: Require password reset can be skipped

=== Require password Reset can be skipped ===
A user that must reset his password can avoid to be redirected to the profile page and access any page/task if the url contains the parameter layout=edit.

The check code was mostly duplicated on site and administrator application.
I have created a new method in class JAppilcationWeb that manage this check, every application can call this method specifying the page that manage the password reset.

In the site application this check must be done after the "route" because parameters 'option', 'view' and 'layout' can be placed anywhere in the url (due to sef urls).
For symmetry i also placed, in the administrator application, the call to the check method after the "route" method is called.

The page that manage the password reset can now be customized for each application using the configuration.php file.

=== How to reproduce the bug ===
Edit a user, and enable the flag "Require password Reset".
After user login to the backend side, he is required to change his password and he is redirected to http://...website.../administrator/index.php?option=com_admin&view=profile&layout=edit&id=473
Every attempt to browse a different page (even a logoff), ends with a redirection to che password change.
But if the user adds the query string &layout=edit he escapes from the password prompt and actually goes to item editing.
For example, supposing that the article with id=1 exists, write the following url:
http://...website.../administrator/index.php?option=com_content&task=article.edit&id=1&layout=edit
Note the query string &layout=edit at the end of the url