[HowTo] Password Change Roundcube 0.5 (and 0.4.2)

[Sweil]

Please tell us: Which file did you use? What is your ispCP version? What is your Roundcube version?

[freinhard]

(02-23-2011 12:42 AM)Sweil Wrote:  Please tell us: Which file did you use? What is your ispCP version? What is your Roundcube version?

ispcp-from-1.0.7.php
ispcp 1.0.7
roundcube 0.5.1 (just updated, same problem)

[Sweil]

please change the password of the mail-user with the false status once per ispcp and then try again with roundcube. whats the result now?

do you have more restrictive password settings in ispcp than in roundcube?

[freinhard]

(02-25-2011 02:55 AM)Sweil Wrote:  please change the password of the mail-user with the false status once per ispcp and then try again with roundcube. whats the result now?

* changed password in ispcp
* login with new password in roundcube
* set yet another new password in roundcube
* see "crypt_md5_data() | [ERROR] Undefined input data, data: || !" in mail_users->status

(02-25-2011 02:55 AM)Sweil Wrote:  do you have more restrictive password settings in ispcp than in roundcube?

no, ispcp default.

[Dylan]

(02-02-2011 10:50 PM)sfera Wrote:  I have the same problem, in webmail the status is set to 'change', in the mysql table the users pass is changed, but in webmail login the old password work, new not.

Any idea??? I do not understand or i'm crazy....

I have the same error too... Have you any suggestions?

---

When I change the password in roundcube, in ispcp.mail_user db the password is changed, but the status field value is: 'change'
When I go to ispcp admin, in e-mail addresses menu, the status is 'change in progress'.
If I modify here an another e-mail address (or create a new), the first e-mail address's password is changed, and status show: 'OK'. After it I can login into the roundcube my new password.

So the roundcube plugin problem is:
After it modify the password and status, something not run in background. (I think)

Any idea?

[Sweil]

Pls tell me the port your ispcp-daemon is listening to.

Some other ideas:
open the ispcp password driver file, search the encrypt_db_password function and remove any "@" you may found. check the error output and check if $td is FALSE after init.

[Sweil]

Ok just for the record, we have 2 different problems here:

1. Status is set to 'change', after password change but new password doesn't work
2. Status is set to 'crypt_md5_data() | [ERROR] Undefined input data, data: || !' and new password doesn't work
   

For those getting the first error: I guess your running the ispcp daemon under an non-default-port or the protocol of the daemon isn't correct (e.g. by using an other ispcp-version). So pls tell me your ispcp-version, your OS and the daemon-port. You may also try to connect to the daemon via telnet. You should see some effect after this conversation:

Code:

<<telnet localhost 9876 [connecting to ispcp-daemon]
>>Trying 127.0.0.1...
>>Connected to localhost.localdomain.
[You are now talking with the daemon]
>>250 OK ispCP Daemon v1.1 Welcomes You!
<<helo 1.0.7
>>250 OK 127.0.0.1/1.0.7
<<execute query
>>250 OK request is being processed.
<<bye
>>250 OK Good Bye!
[you are not longer talking to daemon]
>>Connection closed by foreign host. [telnet message]

>> Daemon Output
<< User Input
[text] Note, don't type this into PuTTY


For those getting the second error:

It is most likely an error within the password encryption. First option, for some reasons (I don't know) the function works different on your system; second option, you have a typo in KEY or IV.

So pls triple-check KEY and IV. After this compare the entries in mail_users->mail_pass after setting a new pw with roundcube and ispCP-Admin-Panel. I must be exactly the same.


PS: As I'm not getting one of this errors, I need your help to locate and fix them.

[sfera]

I dont view any change, for get a solution of this problem.

My users say me, if we go to put a password changer in e-mail or not.

Any idea for solved the problem?

[freinhard]

i finnally nailed the bug. the driver for ispcp 1.0.7 has a function which expects two parameters, the current and the new password. the current password parameter is being processed but never really used. BUT the ispcp password plugin calls password_save with only one argument and the new password ($password) stays empty. so that's never going to work that way...
solution:

remove the first parameter $curpass and comment all lines that use it in the 1.0.7 driver.
in the ispcp_pw_changer.php change the line (somewhere round line 88)

PHP Code:

if (!($res = $this->_save($newpass))) { 


to

PHP Code:

if (!($res = $this->_save($newpwd))) { 


since password_save already encrypts the password and some lines above the password is encrypted also, we would end up with double encryption.

for the author of the plugin:
* please fix the above
* take your time to release a bundled version of the plugin containing both drivers or put it on github or whatever.
* clean the code and don't use function names multiple times like password_save, that's pretty confusing

Thx for your time,

Florian Reinhard

[Sweil]

The project is on github now:
https://github.com/Sweil/Roundcube-Passw...-for-ispCP

(06-18-2011 07:32 PM)freinhard Wrote:  i finnally nailed the bug. the driver for ispcp 1.0.7 has a function which expects two parameters, the current and the new password. the current password parameter is being processed but never really used.

Yep, this was a bug. But doesn't effect any problems in this thread.

(06-18-2011 07:32 PM)freinhard Wrote:  BUT the ispcp password plugin calls password_save with only one argument and the new password ($password) stays empty. so that's never going to work that way...

This is an interface from the roundcube password change plugin. This ispcp-driver does NOT reimplement the exisiting plugin for roundcube.

(06-18-2011 07:32 PM)freinhard Wrote:  solution:
[...]
for the author of the plugin:
* please fix the above
* take your time to release a bundled version of the plugin containing both drivers or put it on github or whatever.
* clean the code and don't use function names multiple times like password_save, that's pretty confusing

Thx for your time,
Florian Reinhard

I think you're dealing with a wrong/old version. None of what you posted may be found in the driver file.