Password request in profile edit does not take special characters

[test---]

I have special characters in my password to make it more difficult to guess, and I can log in with this password without trouble, but in the profile page, when I tried to change my display name, I encountered an "Incorrect password" error.  I never got this problem when I used a simpler password, so I ascertain that it's a result of a the characters I use.  If it would help, in a PM I can give the two characters that I believe are in question to an administrator.

[winrules]

I have special characters in my password to make it more difficult to guess, and I can log in with this password without trouble, but in the profile page, when I tried to change my display name, I encountered an "Incorrect password" error.  I never got this problem when I used a simpler password, so I ascertain that it's a result of a the characters I use.  If it would help, in a PM I can give the two characters that I believe are in question to an administrator.

I've noticed this too. I thought it was just I kept getting my passoword wrong or something, but now that its happened at several different SMF sites and I saw this, I think it's a SMF bug.

[test---]

Yeah, it's definitely a bug then.  I tried multiple times.  But, again, my password works everywhere else, so that's wierd.
The coding for password authentication must have changed between the times when those login boxes were made.

[winrules]

Yeah, it's definitely a bug then.  I tried multiple times.  But, again, my password works everywhere else, so that's wierd.
The coding for password authentication must have changed between the times when those login boxes were made.

Yeah, I'll look at the code and see if I can find anything, I'd really like to see this fixed.

[winrules]

Could you please change the topic title to something like [BUG]Password request in profile edit does not take special characters, it might get more attention that way as it doesn't seem to be getting any right now.

[Dannii]

Which version of SMF?

[winrules]

Which version of SMF?

I use 1.1RC2, I remember having a problem with it in 1.0.x.

[winrules]

Please, can someone take a look at this, it makes it very hard to change anything in account releated settings...

[H]

Which special characters?

[winrules]

Which special characters?

just a "&"

[Thantos]

I was able to change my password and log in with an & character on the 1.1 cvs and 1.1 RC2.

[winrules]

I was able to change my password and log in with an & character on the 1.1 cvs and 1.1 RC2.

try the password "test&test" I tried it and it didn't work. (it always works to log in, just not to verify password in account releated settings)

[Thantos]

Ah I see what you are saying.  You are right with the & in the pw it doesn't verify the password.

[Thantos]

To fix:
File:  Profile.php
Find:

Code Select Expand

// Does the integration want to check passwords?
$good_password = false;
if (isset($modSettings['integrate_verify_password']) && function_exists($modSettings['integrate_verify_password']))
if (call_user_func($modSettings['integrate_verify_password'], $user_profile[$memID]['memberName'], $_POST['oldpasswrd'], false) === true)
$good_password = true;

// Bad password!!!
if (!$good_password && $user_info['passwd'] != sha1(strtolower($user_profile[$memID]['memberName']) . $_POST['oldpasswrd']))
$post_errors[] = 'bad_password';
Add before

Code Select Expand

// Since the password got modified due to all the $_POST cleaning, lets undo it so we can get the correct password
$_POST['oldpasswrd'] = addslashes(un_htmlspecialchars(stripslashes($_POST['oldpasswrd'])));

[Harzem]

Will a patch be released for that? Or will we just be silent until 1.1 Final or RC3

[winrules]

To fix:
File:  Profile.php
Find:

Code Select Expand

// Does the integration want to check passwords?
$good_password = false;
if (isset($modSettings['integrate_verify_password']) && function_exists($modSettings['integrate_verify_password']))
if (call_user_func($modSettings['integrate_verify_password'], $user_profile[$memID]['memberName'], $_POST['oldpasswrd'], false) === true)
$good_password = true;

// Bad password!!!
if (!$good_password && $user_info['passwd'] != sha1(strtolower($user_profile[$memID]['memberName']) . $_POST['oldpasswrd']))
$post_errors[] = 'bad_password';
Add before

Code Select Expand

// Since the password got modified due to all the $_POST cleaning, lets undo it so we can get the correct password
$_POST['oldpasswrd'] = addslashes(un_htmlspecialchars(stripslashes($_POST['oldpasswrd'])));

Thanks a ton, thantos

[Thantos]

Will a patch be released for that? Or will we just be silent until 1.1 Final or RC3

It'll be covered in the next release of 1.1