Password saving problems

[ed]

password not saving and users being repeatedly locked out. this from jim belcher:

1. Mac OS 10.5.8
2. Safari
3. i have never been able to just log in without asking for a new password.
4. Clicking the link on the email, I would get in. the system recognized me as Jim Belcher. I would change my password and save. And the next time i tried to log in, i couldn't and would go through the same routine again.

~

Jim changed to FF and still had this problem. I think there is a big password handling issue going on. See also the confirmation link not working ticket.

[jim]

Sounds like user/computer error - this is the first I've heard of this across dozens of Drupal installs.

Closing for now until there is corroborating evidence from another user WITH exact instructions on how to reproduce.

[ed]

we're still getting this so i'm re-opening it and passing it over to John, what with his one time login links and bloodhound style of deep problem investigation. Another comment today:

"I have tried several times to log in to the transition site. each time I
receive a message that my password is incorrect. On requesting a new
password, I then get an e.mail with a link. When I click on the link I am
then told I'm trying to use a link that has already been used or is invalid.
How can that be when I've just received it seconds earlier."

[ed]

This also is a problem for Cynthia Rabinowitz using FF - so not just an IE thing

[john]

Ed is the user still having problems ? can you get them to forward the email with the login link ? it would be good if we could get an actual example of a login link that does not currently work

[ed]

done - sent you the two confirmation links from Sandra Woolerton...

[ed]

and another sent from Jeanne Mackey - in your inbox...

[ed]

Jeanne Mackey's config is:
OS: windows xp version 2002 sp3
Browser: Internet explorer version 7

[john]

Ed,

Have not had the chance to get into this too much. However, I want to make sure we are not maybe merging one or more issues, any of which could be simply a user error. For instance, Sandra is on user validate, Jeanne is on password reset. Trying to sort one at once..

I have checked Jeanne's user details and have semi-recreated in test. It works fine, at this stage, the only conclusion I can come to is that either she did not click the link properly or a problem is being caused specifically on ie because of the issue of unsecure items on a https connection. Incidentally I have tried it on FF an IE and it worked fine. So...can you get her to request a new password again, try it again and ensure that she does not copy and paste the link, but does click it (if she misses just 1 character of the hash when cutting it won't work and will give her the message that we see in the mail).

Other than that, I have spent an hour trying to recreate it and no joy, I don't have time right now to do anymore....

[ed]

thanks john, bear with it - i've asked her to do exactly what you said - will keep the feedback coming.

yup - the vailidation bug (which has your name on it too) is:
​https://tech.transitionnetwork.org/trac/ticket/7

[jim]

My 2p: This (and #7) are NOT Drupal issues, it's working fine. I've never heard of a login link not working - and realistically, given what it does and how it does it, I can't see a way for it to fail at the website end and not point to other things being corrupted in the system. There is no evidence of that presently.

So I'm pretty sure this is a client-side problem, most probably caused by user's mail clients mangling the long URL link. The mail client used is the only piece of information missing from this bug report and the one that is most likely. As John says, only a single character missing/truncated off the login link would cause these failures.

Questions to ask users: what email site/software are they using? Can they forward their message to Ed? Can they send a screenshot of the link? On closer inspection is the link broken onto two lines? Can they copy/paste the link (reconnecting the pieces if required) and does it work or not? Can they try getting their mail in a different/newer/better client (Thunderbird, Gmail, Hotmail etc)?

Over and out!

[ed]

all good points, and have duly updated my templated reply. it's definitely a problem.

[ed]

I'm not sure this is the same as the validation bug (​https://tech.transitionnetwork.org/trac/ticket/7) as the password reminder email only has one link in it (the truncated one), whereas the registration validation has two (the truncated and the full one at the bottom of the mail).

is that correct?

[ed]

This problem continues and I'm currently getting another wave of angry mails. NO movement yet mate - please update.

Latest now from staff and board members, using XP and Vista. Requesting new password, receiving email, clicking on link, taken to access denied page. not good at all.

Note on Jims' comments earlier is: there is no second link in the password re-set link.

Text of mail here:

Catrina Pickering,

A request to reset the password for your account has been made at Transition
Network.

You may now log in to www.transitionnetwork.org by clicking on this link or
copying and pasting it in your browser:

​https://www.transitionnetwork.org/user/reset/1032/1284469190/be1969f86fe...

This is a one-time login, so it can be used only once. It expires after one
day and nothing will happen if it's not used.

After logging in, you will be redirected to
​https://www.transitionnetwork.org/user/1032/edit so you can change your
password.

[ed]

fixed - drupal update, combined with fancy login and logintobbogan conflict in Sept sorted this out. it was to do with the cookie domains.