Thread: Trouble changing/ressetting password for fourm.

It seems there might be an issue with resetting passwords. Right now we don't have a direct way for users to change their password, but we do have a password reset feature that accomplishes essentially the same thing.
Make sure you're not logged out of the forum and then visit this link and follow the instructions: Password reset initiation

However, this doesn't seem to be working for @vorin and maybe others. This thread will be used to diagnose the problem with the assistance of vorin.

This problem was first brought up in another thread: Major Forum Changes Ahead
We are continuing here as to not clutter up that thread.

@vorin there are actually 3 reasons this might fail (account inactive/banned, wrong e-mail confirmation code, or time-limit expiration).
I'm going to update the error messaging to report back exactly why the reset fails so we can get a better idea of where to look. Once I've finished that I'll let you know to try again.
Sorry for the trouble. I hope you're willing to work with me to solve this issue.

Of course!

@vorin Go ahead and give the reset another try and post a screen shot of the error please.

The password reset failed because the given user ID and authentication token did not match what was expected. Please follow the link provided in the password reset e-mail exactly as it is written. You may need to disable any browser or e-mail client extensions that may alter the URL.

Given user ID: 892
Given authentication token: [redacted]
Username: vorin
Reset at: 2022-06-14 13:03:13

@vorin can you also PM me the full, entire link you were given in your e-mail please?
(Don't post it here.)

Vorin, I'm quite sure I've figured it out. It just came to me. I haven't had time to test it or implement it yet, but I'm pretty sure I know what's going on.
I'll let you know some time tomorrow when you should test again.

@vorin I think I have it completely figured out now. Go ahead and try to reset your password. It should work now.

The flash of inspiration last night was realizing I was probably not handling the situation properly when someone entered their e-mail address into the password reset form using a different case than what the forum has on file. E-mail addresses are not case sensitive in practice, so quite often people might use different capitalization for their address at times and normally things work just fine. However, while the address would pass my validation, it would then be compared incorrectly. So if you had "Example@Domain.net" as your e-mail address on file with the forum but entered "example@domain.net" in the password reset form then that would pass validation (because a long while back I made sure to ignore case for the validation) but ultimately it would fail at a later comparison since they were not equal. The solution was to ignore case when comparing them later as well.
This solved one problem, but I then quickly realized a similar thing was happening for the user name. Entering a user name like "benfenner" would pass the validation check, but not pass the later comparison because the user name is actually "BenFenner". So I made sure user names were validated properly, and reject user names with incorrect case, urging the user to make sure they are capitalizing it properly.

So after fixing both of those situations, I believe this feature is quite robust now. And as a bonus, it now has better error reporting for when things go wrong.


I've updated the changelog: Update (Version 1.5.12)

That's a bingo!

Thanks for the help

I'm glad to hear it worked out for you. Sorry for the trouble, and thank you for helping me fix it!