Jump to:

1030 Posts in 805 Topics by 311 members

Forum Module

SilverStripe Forums » Forum Module » Password troubles - Profile and lost password

Discuss the Forum Module.

Moderators: martimiz, Sean, biapar, Willr, Ingo, swaiba, simon_w

Page: 1 2
Go to End
Author Topic: 2401 Views
  • freakout
    Avatar
    Community Member
    49 Posts

    Password troubles - Profile and lost password Link to this post

    When a Forum User maintains data in his profile and does not fill the two password fields, the password is set to NULL in the database. This leads to outlock this user from the forum.

    This is especially annoying because lost Password Form is also not working!

    The user does receive the email reset password, but after clicking it, he is asked to login, which requires to input the password, but this password has been lost or resetted by the malicious profile settings form!

    Any help would be appreciated.

  • Willr
    Avatar
    Forum Moderator
    5489 Posts

    Re: Password troubles - Profile and lost password Link to this post

    What version of Forum are you using?

  • freakout
    Avatar
    Community Member
    49 Posts

    Re: Password troubles - Profile and lost password Link to this post

    Using: silverstripe-2.4.0 with forum-0.3-r106922

  • freakout
    Avatar
    Community Member
    49 Posts

    Re: Password troubles - Profile and lost password Link to this post

    Willr - no idea to fix this?

  • Willr
    Avatar
    Forum Moderator
    5489 Posts

    Re: Password troubles - Profile and lost password Link to this post

    Hmm I am unable to reproduce the issue (of setting the password to null). Heres what I tried -

    * Registering a user with password 'test' - this was added to the db
    * Editing the users profile (with not setting anything in the password field)
    * Editing the users profile in the cms (with not setting anything in the password).

    Looking at the code also has empty() checks to ensure that passwords could not be set to nothing. Saying that I think this area needs some unit tests to ensure I'm not missing something or an edge case. It is the edit profile form on the front end which is setting the password to null correct?

  • freakout
    Avatar
    Community Member
    49 Posts

    Re: Password troubles - Profile and lost password Link to this post

    Yes - the Front-End profile editor - i just tested the behaviour again - i only changed the signature and left the password fields empty - after submit the Password is NULL in the database. i could reset the password with the profile form within the same session by filling the two password fields. You can just test it on http://icybolt.de/larp-forum/ - just create an account - log in and change your signature - when you log out you can no more login because your password is NULL in the database.

  • draft
    Avatar
    Community Member
    57 Posts

    Re: Password troubles - Profile and lost password Link to this post

    hi, this also happened to me..

    I think it's because the 2.4 version, when u do this $member = DataObject::get_by_id('Member', $data['ID']); , it return NULL on the password data, if i print out the dataobject, there are two password displayed, one is null, the other is the current password, the problem is, it get the first one so on $form->dataFieldByName("Password")->setValue($member->Password);, it set a null value.

    the PasswordEncryption also set to null..

    Anyone has idea on this?

  • draft
    Avatar
    Community Member
    57 Posts

    Re: Password troubles - Profile and lost password Link to this post

    It turn out if i changed the get_by_id to get_one , it worked,
    so the member query would be $member = DataObject::get_one('Member', 'ID='.$data['ID']);

    Hope this could help someone...

    2401 Views
Page: 1 2
Go to Top

Want to know more about the company that brought you SilverStripe? Then check out SilverStripe.com

Comments on this website? Please give feedback.