[snippet] problem with webchangepwd process and sessions and security in modx

Hi all,
it’s a lot of days that i’m working with the weblogin snippets finding a lot of problems. First of all, I’ve tried to internationalize it with changes reported in this thread http://modxcms.com/forums/index.php/topic,5063.0.html. There I add also another email field to prevent typing errors by the user during the subscription process.
Now, I’m dealing with the webchangepwd snippet, part of the weblogin, and I find really singular behaviours from this snippet.
First of all it seems that do not make any changes without reloading the page with all the POST attachment. When I submit the request to change the password, it return to the starting point showing me the change password form. If I reload the page it submit and save the new password giving me the confirmation.
After that, if I try to return to the change password page (to change it another time) the snippet always show me the previous confirmation. If a explicitly logout, and login again, it always show me the confirmation (not the change password form). This seems to say that modx do not end user sessions with an explicitly logout.
But the most singular behaviour is that if I login with other users (from the same computer) and open the change password page (also from different browsers!!!), it always show me the other user confirmation (if I asked to show the pass on the screen, I see the other user password on the screen!!!!!!!!! ).
I don’t know if I have something particulary on my website, but if not, these are serious problems.

Besides this, I think that this snippet needs to be improved with a full account management page for the user, internationalized and fixed. I think to write a new version with at least the full account man.page, but before I do it, is there someone that can explain or know how to fix the problem I found? Or perhpas knows where is the problem.

At the moment I’m not able to kill user session form the DB. I don’t understand which is the process used to manage sessions in Modx, cause is almost (or it should) impossible that I see the same page (the confirmation page) with different users.

Any help or contribute will be appreciated.
Thanks

I found this post after reviewing a bug report; sorry if I missed it first time around.

First of all, it sounds like you may have a caching issue with your weblogin snippet calls -- these must be called on uncached pages or you must use the uncached snippet tags to call it (e.g. [!WebLogin!] instead of [[WebLogin]]).

Second, you cannot login to multiple user accounts simultaneously. A session is defined as a unique browser connection to the server. That is standard PHP session behavior. What we do allow is you to login to the manager and front-end separately, maintaining tokens separately for manager and web users. If you logout as a webuser, you can login as a different one, and it will not affect the manager session. But currently, if you logout of the manager, the web user session is also affected. This will change in the near future, so that you can logout of manager or front-end without affecting the other login. But essentially, it’s all in the same session.