forgotten password token does not work

[leolam]

Abernyte,

Thanks for the suggestion but it is not a core solution to the issue. I refuse to go and hanky panky code

Thanks anyhow for sure

Leo

[wicko]

thanks for the suggestion Leo
Will feel more secure with 1.5.15

[deleted user]

1) The password reset token is working on my site. Server specs (please no speech about upgrading, I've tried to talk to provider about this, they are firm about not upgrading (and since I'm paid for several more months...):

Apache 1.3.37
PHP 4.3.11
MySQL 4.1.14
(if further detail necessary, will post Forum Post Assistant results)

2) Compared code from my components/com_user/controller.php to that posted by abernyte, current version code is exactly like what he has.

3) Pulled pre-1.5.16 backup components/com_user/controller.php file and reviewed code, the code there is exactly what is found in my 1.5.17 version.

My assumptions/conclusions:

1) If the early release of the upgrade was indeed messed up and this caused the error, then re-applying the patch (or, if nothing else, this file specifically with "good" code) should resolve the issue.

2) The error is due to corrupted files on the site's server and re-applying a full installation should resolve the issue.

3) If this is indeed a bug, it needs to be determined what is causing this bug for select individuals, hence the previous request for operating environments (although, any extensions that have modified the user management system should be included also I think).

[leolam]

My assumptions/conclusions:

Have been already all addressed if you read carefully ?

Leo

[brynk]

I rolled my website back to Joomla CMS 1.5.15 and password request is working. I think I will sit this one out for a week or two. If you would like me to test revisions, I would be glad to assist.

Regards
Bob Rynkiewicz

[deleted user]

My assumptions/conclusions:

Have been already all addressed if you read carefully ?

Leo

I have. I'm just throwing my gut feeling & opinion on the matter out there, and that opinion is that I honestly believe this isn't a bug or a dev issue. But, as they say, opinions are like a certain type of hole...

That said, looks like we're comparing two different blocks of code. The code at line 377 is for the request function, while the code identified in the bug by the OP is in the confirmation function beginning at line 399.

There are two changes between this version of components/com_user/controller.php and the previous version, including adding a line at line 406 and changing a false to true (the diff is located at http://joomlacode.org/gf/project/joomla ... 1&r2=16385).

I haven't seen anywhere that anyone specifically's pointed out that change, minus the OP in the bug. Seems a lot of people, myself included, first looked at the request function.

[deleted user]

OK, downloaded and got Joomla running via Jumpbox. Patched it from 1.5.15 to 1.5.17, made a new user, and reset the password, without any issue. Forum Post Assistant info for the Jumpbox install:

[quote="JTS-post Problem Description"]Testing Password Reset in Jumpbox[/quote][quote="JTS-post Actions Taken To Resolve"]1) Installed Jumpbox
2) Patched from 1.5.15 to 1.5.17
3) Created new user
4) Requested password reset
5) Completed password reset[/quote]

Joomla! Version: Joomla! 1.5.17 Stable [ Wojmamni ama woobusani ] 27-April-2010 04:00 GMT
configuration.php: Not Writable (Mode: 644 ) | Architecture/Platform: Linux 2.6.24-27-generic ( i686) | Web Server: Apache/2.2.8 (Ubuntu) PHP/5.2.4-2ubuntu5.10 with Suhosin-Patch mod_ssl/2.2.8 OpenSSL/0.9.8g | PHP Version: 5.2.4-2ubuntu5.10
PHP Requirements: register_globals: Disabled | magic_quotes_gpc: Enabled | safe_mode: Disabled | MySQL Support: Yes | XML Support: Yes | zlib Support: Yes
mbstring Support (1.5 or above): Yes | iconv Support (1.5 or above): Yes | save.session_path: Writable | Max.Execution Time: 300 seconds | File Uploads: Enabled
MySQL Version: 5.0.51a-3ubuntu5.5 ( Localhost via UNIX socket )

SEF: Disabled (without ReWrite) | Legacy Mode: Disabled | FTP Layer: Enabled | htaccess: Not Implemented
PHP/suExec: User and Web Server accounts are not the same. (PHP/suExec probably not installed)
PHP Environment: API: apache2handler | MySQLi: Yes | Max. Memory: 64M | Max. Upload Size: 20M | Max. Post Size: 8M | Max. Input Time: 60 | Zend Version: 2.2.0
Disabled Functions:
MySQL Client: 5.0.51a ( latin1 )

[leolam]

thanks for the suggestion Leo
Will feel more secure with 1.5.15

This http://forum.joomla.org/viewtopic.php?p ... 3#p2127703 resolves the issue

Leo

[humvee]

Adding the possible solution to this issue for others to view -
Confirm password in 1.5.16/1.5.17

From Joomla! Documentation

If you are getting a Token Error when confirming a password reset after upgrading to Joomla! 1.5.16, or later, and if you are using Template Overrides for the com_user Component, reset view, and confirm layout, then you must manually change your layout file to include a new username field. Adding that field will fix the token error.

See http://docs.joomla.org/Confirm_password_in_1.5.16

[wicko]

Hi All

I updated using the code on here http://docs.joomla.org/Confirm_password_in_1.5.16

Everything now seems ok.

Many thanks to everyone for all your help and quick resolve to this problem. I hope it helps everyone else with the same issue.

David ( Wicko)

[humvee]

Glad it got there in the end.

[leolam]

Andy,

So far we have identified the following template clubs using the mechanism:

* Rockettheme,
* Yootheme
* Joomlart
* Gavick
* Shape 5 (identified by Brynk)

Please feel free to add more to the list to benefit the users? (maybe abstract this part and post as separate issue?)

note to template clubs: This is to help users of your fabulous templates so they know what to do! This is no blaming festival since you have done your job well so we just want to make sure that people understand that with certain templates this issue will arise and that users need to do something, as you need to do something in your packages as well! I know for instance RT has already upgraded all systems with the updated confirm.php so please help your clients and upgrade asap or make notice on your sites how they should upgrade your particular version of this file?

Leo

[brynk]

Thank You for identifying the problem. Unfortunately for me 90% of my customers use templates by the above mentioned template suppliers. Great clubs, great templates, and a much appreciated understanding of why things went haywire.

Lesson learned -- wait to upgrade and watch the forums before doing so.
LOL

Oh -- add Shape 5 to your list.

Bob Rynkiewicz

[humvee]

@Leo added supplementary note to sticky

[kinsh]

Hello Everyone,

I had same problem with my site. I was just able to solve it. I uploaded com_user folder again and it got fixed. In any case, you are not fixing the problem, you can check the attachment and try to upload this in templates/template-name/html

If you are able to fix it, please let me know. It will just confirm that the solution worked.! :-)

Many Thanks.

[art knotly]

I rolled back too due to all the mess!

ugh!

ajs
http://basementdetective.com