Topic on Project:Support desk

Hi all,

We've a problem changing the temporarily password assigned by Extension:ConfirmAccount. Because I suspect it's a more general problem I post it here.

Problem is that the password apparently isn't changed after submitting a new one.

Use case:

- After creation of the account and logging with the given temporarily password I get the message "You logged in with a temporary emailed code. To finish logging in, you must set a new password here".

- I change the password (submitting 2 times a new value)

- I get no error message and I'm being redirected (so successful login) to the homepage.

- BUT: if I log off and try to login again I've to use the old/temporarily password, the new one is not accepted

- If I repeat this (login in with the old password, enter a new one) and go directly to the Speciaal:ChangeCredentials page and change the password, log off and log in again, it works fine.

Anybody who can help us?

It's a black box to me. Where do I have to look for an error message?

We use MW 1.27 and the REL1_27 branch of ConfirmAccount.

Thanks in advance for your help.

Regards,

Jethro

In the meantime we (Waanders and me work together) have applied a (temporary) patch in the mediawiki-code to avoid the step for changing the temporary password.

in File: /home/hz01/mediawiki/core/includes/auth/TemporaryPasswordPrimaryAuthenticationProvider.php

the following is changed:

        protected function getPasswordResetData( $username, $data ) {

                // Do not reset password (workaround!)

return [];

        /*      return (object)[

                        'msg' => wfMessage( 'resetpass-temp-emailed' ),

                        'hard' => false,//true,

                ];*/

        }

This means that the user is nog obliged to change his/her password after they receive the email.

Of course this is not optimal, and we would like to know:

a. if there is another (official) way to step over the forced changing of the temporary password

b. (Better!) is there a way to store the newly entered password?

Nobody?

It's an urgent problem, help is greatly appreciated.

Maybe you can try disabling all cache and see if it changes anything? In case the Wiki is using HTTPS, does the $wgServer value also include https://, or a protocol-relative URL? Maybe even try disabling all other extensions as some can come in the way of proper working of MediaWiki.

The last option would then have to be to try upgrading MediaWiki. Version 1.27 will be obsolete in June 2019.

Thanks!

What cache do you mean?

$wgServer includes "https://".

Meanwhile we have discovered that it's a more general problem. Same problem with Speciaal:ChangeCredentials/MediaWiki%5CAuth%5CPasswordAuthenticationRequest, so it's not a ConfirmAccount problem.

Such as Manual:$wgMainCacheType.