Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Logging in as an inactive user invalidates their activation token #4130

ccchapman opened this Issue Apr 11, 2019 · 1 comment


None yet
2 participants
Copy link

ccchapman commented Apr 11, 2019


Creating a new user (and sending them their activation email) breaks if you sign into their account using the "Login as..." feature.

Steps to reproduce

  1. Create a new user and send them an activation email.
  2. Sign into their account with the "Login as..." feature while their account is pending activation.
  3. User tries to activate their account and receives and "Invalid Verification" error message.

Stack Trace

yii\web\HttpException: Invalid verification code. Please login or reset your password. in /home/vagrant/craft/vendor/craftcms/cms/src/controllers/UsersController.php:1968
Stack trace:
#0 /home/vagrant/craft/vendor/craftcms/cms/src/controllers/UsersController.php(1936): craft\controllers\UsersController->_processInvalidToken()
#1 /home/vagrant/craft/vendor/craftcms/cms/src/controllers/UsersController.php(405): craft\controllers\UsersController->_processTokenRequest()
#2 [internal function]: craft\controllers\UsersController->actionSetPassword()
#3 /home/vagrant/craft/vendor/yiisoft/yii2/base/InlineAction.php(57): call_user_func_array(Array, Array)
#4 /home/vagrant/craft/vendor/yiisoft/yii2/base/Controller.php(157): yii\base\InlineAction->runWithParams(Array)
#5 /home/vagrant/craft/vendor/craftcms/cms/src/web/Controller.php(109): yii\base\Controller->runAction('set-password', Array)
#6 /home/vagrant/craft/vendor/yiisoft/yii2/base/Module.php(528): craft\web\Controller->runAction('set-password', Array)
#7 /home/vagrant/craft/vendor/craftcms/cms/src/web/Application.php(297): yii\base\Module->runAction('users/set-passw...', Array)
#8 /home/vagrant/craft/vendor/craftcms/cms/src/web/Application.php(561): craft\web\Application->runAction('users/set-passw...', Array)
#9 /home/vagrant/craft/vendor/craftcms/cms/src/web/Application.php(281): craft\web\Application->_processActionRequest(Object(craft\web\Request))
#10 /home/vagrant/craft/vendor/yiisoft/yii2/base/Application.php(386): craft\web\Application->handleRequest(Object(craft\web\Request))
#11 /home/vagrant/craft/web/index.php(21): yii\base\Application->run()
#12 {main}
  • Craft version: 3.1.19 & 3.1.22
  • PHP version: 7.2.16

This comment has been minimized.

Copy link

brandonkelly commented Apr 16, 2019

Thanks for pointing that out! Fixed for the next release.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.