Demo Discussion
Forum Config Examples Contributions Vulnerabilities
  Discussion forum about ELOG  Not logged in ELOG logo
icon4.gif   Forgot Password, posted by Christopher Lee on Mon Apr 16 11:10:07 2012 elogd.cfg
    icon2.gif   Re: Forgot Password, posted by Stefan Ritt on Mon Apr 30 17:05:28 2012 
       icon6.gif   Re: Forgot Password, posted by Christopher Lee on Tue May 1 09:20:00 2012 
          icon2.gif   Re: Forgot Password, posted by Stefan Ritt on Wed May 2 09:17:56 2012 
Message ID: 67250     Entry time: Mon Apr 16 11:10:07 2012     Reply to this: 67255
Icon: Warning  Author: Christopher Lee  Author Email: chris@chrisandclaire.org 
Category: Bug report  OS: Linux  ELOG Version: 2435 
Subject: Forgot Password 

We seem to have a problem with retrieving user passwords using the forgot password system
This only happens when trying to use the password recovery from the first screen that forces people to log in with the following syntax:

Protect selection page = 1
Password file = XXXXX

On the first page of our elog which can be found at

http://physics.uj.ac.za/elog/

Now currently there is one page that is viewable by guests, so going to this direct link, bypasses the login at the main page
If you try login from this page, and then use the forgot password link, the email that gets sent through will then work.

The first email that gets sent through using the main login page has the following link:
https://physics.uj.ac.za/elog/?redir=%3Fcmd%3DChange+password%26oldpwd%3DYJAATGHSIRRSBLLP&uname=Tester&upassword=YJAATGHSIRRSBLLP

When clicking on the above link normally, it takes you to a NULL user

 

The email link that gets sent from the guest page, that works, looks like this:
https://physics.uj.ac.za/elog/General/?redir=%3Fcmd%3DChange+password%26oldpwd%3DSACWEHJWWHKEXLMO&uname=Tester&upassword=SACWEHJWWHKEXLMO

 

Attached is a copy of the cfg file. The last few logbooks are all actually just copies of TEMPLATE A, so I have removed all their details to make the file easier to read for now
 

Attachment 1: elogd.cfg  4 kB  | Show | Show all
ELOG V3.1.5-2eba886