Installer destroys admin PW
- Status
- Open
- Subject
- Installer destroys admin PW
- Version
- 18.x
- Category
- Bug
- Feature
- Installer (profiles, upgrades and server-related issues)
- Resolution status
- New
- Submitted by
- hman
- Lastmod by
- hman
- Rating
- Description
When upgrading my trusty old installation of 12.14, which seemingly went through without errors, after it was completed, there is a mentioning in the installation wizard that sometimes the ability to log-in as admin might be lost.
This has struck here. Unfortunately, once you dismiss this information and proceed to log-in (with or without locking the installer) you'll never see this text (and the help offered therein) again...
After finishing the installer, I could not log-in as admin to unlock the site. And, as I wrote, the info is never shown again...
So I went to the database and I think I found the culprit.
In the table users_users I see that the record containing the admin carries a new password. According to my backup, the PW should be starting with "$1$9", but it is "$2y$10$".
According to PHP documentation the first characters before the dollar signs merely indicate the cryptographic method used for hashing. And it should be normal that from time to time PW will be re-encrypted by new methods like blowfish, or key lenghts. PHP docs even recommend automating this.
But due to the one-way nature of hashing it is impossible to re-encrypt passwords without help from the user, here the admin. The PW has to be entered fresh and then encrypted with the new method. It's impossible to decipher and re-crypt.
So if in the short time-span between the backup I drew and the run of the installer, the PW changes in the DB and changes cryptographic method, it must have been tampered with!
One more nail in Tikis coffin for me.
- Importance
- 10 high
- Easy to solve?
- 5
- Priority
- 50
- Demonstrate Bug on Tiki 19+
-
This bug has been demonstrated on show2.tiki.org
Please demonstrate your bug on show2.tiki.org
Show.tiki.org is not configured properlyThe public/private keys configured to connect to show2.tiki.org were not accepted. Please make sure you are using RSA keys. Thanks.
- Demonstrate Bug (older Tiki versions)
-
This bug has been demonstrated on show.tikiwiki.org
Please demonstrate your bug on show.tikiwiki.org
Show.tiki.org is not configured properlyThe public/private keys configured to connect to show.tikiwiki.org were not accepted. Please make sure you are using RSA keys. Thanks.
- Ticket ID
- 7905
- Created
- Sunday 31 October, 2021 23:59:24 UTC
by hman - LastModif
- Tuesday 02 November, 2021 11:21:51 UTC