"Forgot Password" troubles

[rabsaul]

Hm. I've got a kink here. I imagine it's a problem in settings, but I don't know what. Both on a site I set up, and another site on the same server, there is a problem with this function. When one clicks on forgot password, it resets the password - and also fails to send the email. Meaning that we get locked out. So, two questions:

1) what do I need to reupload in order to clear things and reset passwords manually?

and

2) what setting would likely be causing the conflict here?

Thanks.

tim

[ruebenwurzel]

Hello,

this is a known bug. Stefan works on a solution. Look at the project page at timeline. There are some changes at different files wich should solve this. Not yet tested, so before changing your files make a backup.

Matthias

[rabsaul]

Hello,

this is a known bug. Stefan works on a solution. Look at the project page at timeline. There are some changes at different files wich should solve this. Not yet tested, so before changing your files make a backup.

Matthias

Thanks, Matthias. I think I found it here: http://projects.websitebaker.org/websitebaker2/ticket/136

Unfortunately, WB won't send the password more than once per hour, so I don't know if it's fixed yet....

[rabsaul]

This still isn't working. I changed line 99 in that file, so that it would be admin rather than wb. But now that the hour has expired and I try to get the password sent, I get this message:

Unable to email password, please contact system administrator

What now? 

[rabsaul]

So... short of starting all over, how can we get back in? The only "living" account is a basic user level one, now. I'd obviously like the problem genuinely fixed, but short of that, we certainly need to re-establish the admin account.

Thx.

[pcwacht]

question:
does other mail get send by WB ??


quick 'n dirty hack,
change admin/login/forgot/index(.)php to echo the newpass

add after line 96:

Code:

// Try sending the email
echo $mail_message;
exit();

remove this hack when you get in again.

John

[rabsaul]

question:
does other mail get send by WB ??

It appears to be - at least, the contact form goes thru the right steps - the email address isn't mine; this is a site I'm setting up for someone else. However, when I first set it up, I tested it with my email address, so I know that it definitely was working.

quick 'n dirty hack,
change admin/login/forgot/index(.)php to echo the newpass

add after line 96:

Code:

// Try sending the email
echo $mail_message;
exit();

remove this hack when you get in again.

Thanks, I'll give that a try.

[rabsaul]

question:
does other mail get send by WB ??


quick 'n dirty hack,
change admin/login/forgot/index(.)php to echo the newpass

add after line 96:

Code:

// Try sending the email
echo $mail_message;
exit();

remove this hack when you get in again.

John

That code isn't working for me. I still get this message:

Unable to email password, please contact system administrator

but no sign of the login info.

[koiki]

I had a similar pb during sign-up. I changed the mail function and now it works.
Here is what I did:
1/ edit ./framework/class.wb.php
2/ change line 254:
if(mail($toaddress, $subject, $message, $headers, "-f  $fromaddress")) {
to
if(mail($toaddress, $subject, $message, $headers)) {

For me, this solved the pb. I think you must also have an operational mail system on your server...

[pcwacht]

@Koiki

What mailsystem do you have?
Do you run windows?

John

[koiki]

No I'm running a debian sarge with exim as mta.

[pcwacht]

Did some digging.....

according to http://nl3.php.net/function.mail

mail($toaddress, $subject, $message, $headers, "-f  $fromaddress")
the -f $fromaddress = the fifth parameter!

The php mail() function uses 5 parameters as of php 4.05 (the fifth was added then)
Since PHP 4.2.3 this parameter is disabled in safe_mode and the mail() function will expose a warning message and return FALSE if you're trying to use it.

Since phpsafe needs to be disabled for wb I can think of one thing only
you use php version < 4.05 ??


If so we can enhance the wb mailfunction to check php version and add the fifth parameter when php is big enough


John

[koiki]

I'm using php 4.3.10 and safe_mode is off.
If I really understand the -f parameter of the mail() function it's useful for sendmail. But is it useful for exim? does exim understand this parameter?Maybe it doesn't.

[rabsaul]

Just an update: I got confirmation this morning that the email I sent to the guy I did the site for went thru.

However... I just realized that I created that contact form manually with a formmail script. So I guess that doesn't prove anything regarding whether WB's native email functions are working.

[rabsaul]

Did some digging.....

according to http://nl3.php.net/function.mail

mail($toaddress, $subject, $message, $headers, "-f  $fromaddress")
the -f $fromaddress = the fifth parameter!

The php mail() function uses 5 parameters as of php 4.05 (the fifth was added then)
Since PHP 4.2.3 this parameter is disabled in safe_mode and the mail() function will expose a warning message and return FALSE if you're trying to use it.

Since phpsafe needs to be disabled for wb I can think of one thing only
you use php version < 4.05 ??


If so we can enhance the wb mailfunction to check php version and add the fifth parameter when php is big enough

John, I had assumed you were asking Koiki these questions, but maybe I misunderstood.

The PHP version on the servers I'm on is 4.4 and safe mode is disabled. So those are not issues. Linux servers, but I'd have to check the variant. (PHP info is here: http://cpanel18.gzo.com/phpinfo.php but I guess that's not where I'd figure that out.)

This is obviously a basic function, and it's make or break if I'm going to be installing this for other people (it's not much, but at $50 donation to WB per client, WB stands to gain quite a bit in the long haul).

So again, what can I do here?

[pcwacht]

@Rabsaul,
You still have troubles getting into admin?
Try editing the database - table wb_users, with phpmyadmin you can edit the record and set the password,
change the field password and make sure to select MD5 as function


@Others concerning mail from WB

In 2.6.2 we changed the way mail is done within WB to put up a barrier against mailinjections we made a new mail routine in class.wb.php wich now is used by every core script wich needs to mail

In prior versions each module/script wich needed mail did a direct mail call

The -f parameter was added to make sure the fromaddress was added correctly (antispammeasuremeny)

Allso a check on wich OS is set in settings is used to determine the "\r\n" "\n" issue (windows uses \r\n, linux \n)

The WB-mail routine still uses php's build in mail function, so you need a mailserver on your host (wich luckely is in most cases)

Hope this helps, and let me know, cause we can't have WB not mailing..

John
 

[rabsaul]

@Rabsaul,
You still have troubles getting into admin?
Try editing the database - table wb_users, with phpmyadmin you can edit the record and set the password,
change the field password and make sure to select MD5 as function
 

Let's say that works (I haven't used phpmyadmin very much at all). But what happens next time a password is lost? It's not clear to me that anything is resolved, other than the possibility to get in with a "back door" method that I can't expect from the client. Am I missing something?

[rabsaul]

I'm afraid I'm not understanding this phpMyAdmin info at all...

I've got to a section where there is a table with the following fields: user_id, group_id, active, username, password etc.

The usernames, display names and email addresses all show correctly. But the visible passwords aren't right. I tried using the admin password there and it failed. No surprise, the secondary user account (which hasn't been reset) still works with the original password I assigned it - and yet, that is not what is showing in that table. So I'm obviously not understanding something here, or else there is a glitch somewhere.

[pcwacht]

The password is encoded with MD5

That is why you need to select the MD5 in the dropdown list next to the password field (between the password field and the area where you can enter the data you need)
This way you can enter the password in humanreadable text, phpmyadmin will encode it with MD5 and it should work again

Try selecting the md5 bit , if this couldn't be done let me know and I can make a pass, md5 it and send the coded pass so you can admin your wb again.



You have troubles in this install cause of the mail issue.
The new password isn't mailed to you so you don't know the new pass and can't get in anymore

This is not normal beaviour for wb. It might be a new bug we haven't come across.

John

[rabsaul]

The password is encoded with MD5

That is why you need to select the MD5 in the dropdown list next to the password field (between the password field and the area where you can enter the data you need)
This way you can enter the password in humanreadable text, phpmyadmin will encode it with MD5 and it should work again

Try selecting the md5 bit , if this couldn't be done let me know and I can make a pass, md5 it and send the coded pass so you can admin your wb again.

Ah, that's what your mention of MD5 was about. Unfortunately, I don't see anything here indicating it is MD5. I'll have to do a search in the documentation, I guess.

You have troubles in this install cause of the mail issue.
The new password isn't mailed to you so you don't know the new pass and can't get in anymore

This is not normal beaviour for wb. It might be a new bug we haven't come across.

Yeah, although it's not unique to this install; someone else I recommended WB to (on same server) had the problem too (and in fact that's what alerted me to check whether this particular account was working).

[rabsaul]

Try selecting the md5 bit , if this couldn't be done let me know and I can make a pass, md5 it and send the coded pass so you can admin your wb again.

Ah, I think I misunderstood you... yes, the password can be selected via the mouse; that's how I tested it and discovered it didn't work straight up. So you can encrypt a password for me, email it to me, and I can enter it in the password field? That would be great, thanks. My email is tim @ timgallant . org (remove spaces).

I sure hope we can get this mail issue resolved soon. It's pretty worrisome. Can't figure why other people don't seem to be having a problem. I suppose there are all sorts of variables in server setup...

[rabsaul]

Try selecting the md5 bit , if this couldn't be done let me know and I can make a pass, md5 it and send the coded pass so you can admin your wb again.

Ah, I think I misunderstood you... yes, the password can be selected via the mouse; that's how I tested it and discovered it didn't work straight up.

Hm. I can select it, and I can copy, but I don't see how to paste or enter manually.... 

[pcwacht]

You wrote 'same server'

it might have to do with the way that server handles mail

try removing the -f $fromaddress bit :

1/ edit ./framework/class.wb.php
2/ change line 254:
if(mail($toaddress, $subject, $message, $headers, "-f  $fromaddress")) {
to
if(mail($toaddress, $subject, $message, $headers)) {

I think here lies your problem.


About the password, start phpmyadmin and copy the password from the testuser to admin and login as admin with the testusers pass
Then change the pass for admin.

If you don't know how to handle phpmyadmin enough, contact me on pm

Good luck,
John

[rabsaul]

You wrote 'same server'

it might have to do with the way that server handles mail

try removing the -f $fromaddress bit :

1/ edit ./framework/class.wb.php
2/ change line 254:
if(mail($toaddress, $subject, $message, $headers, "-f  $fromaddress")) {
to
if(mail($toaddress, $subject, $message, $headers)) {

I think here lies your problem.

Thanks, I'll give that a try.

About the password, start phpmyadmin and copy the password from the testuser to admin and login as admin with the testusers pass
Then change the pass for admin.

If you don't know how to handle phpmyadmin enough, contact me on pm

Yeah, I obviously don't know my way around phpMyAdmin. As I note in the previous message, I don't see how to enter anything into the password field, although I can copy from it. Otherwise, your suggestion would be the "No, duh!" solution.

[pcwacht]

it might have to do with the way the server handles mail

try removing the -f $fromaddress bit :

Quote
1/ edit ./framework/class.wb.php
2/ change line 254:
if(mail($toaddress, $subject, $message, $headers, "-f  $fromaddress")) {
to
if(mail($toaddress, $subject, $message, $headers)) {

This solved the email issue, thus solved the password change issue


John