MyBB Community Forums

Full Version: [F] PunBB - passwords and administrator permissions
You're currently viewing a stripped down version of our content. View the full version with proper formatting.
Pages: 1 2 3
Quote:I spoke too fast... After login/logout with those two accounts, I check "admin" to make sure I wasn't dreaming about the lost admin permissions (and I wasn't) and now I can't login with "iryx" or my test user either: wrong password.

Hopefully I had another test user so I just checked. The first time I try to log in, it goes alright. I then log out and try to log in again and I get the wrong password error message :/

I had similar problems with the loginconvert. My test accounts that used loginconvert just couldn't login properly.

Quote:Second, the loginconvert.php plugin needs to be activated in order to convert passwords for imported users from punBB.

I don't see this documented anywhere? Remember that the a person doing a conversion is more than likely VERY new to mybb and will need precise instructions. Even I wasn't aware it needed to be activated. I just assumed it needed to be uploaded.

There is a lack of documentation for the merge system...almost no instructions.

	echo "Warning: You should upload loginconvert.php to inc/plugins if you wish to convert passwords.<br />";

That's all it says...nothing about activating it. Could you possibly run the activation from the convert files incase it's not activated? Just an idea to help simplify the matter. First check if it's activated and if not...auto activate it.

Maybe I spoke too soon..does this auto-activate it?


Quote: if(file_exists(MYBB_ROOT."inc/plugins/loginconvert.php"))
{
$plugins_cache = $cache->read("plugins");
$active_plugins = $plugins_cache['active'];

$active_plugins['loginconvert'] = "loginconvert";

$plugins_cache['active'] = $active_plugins;
$cache->update("plugins", $plugins_cache);
}
labrocca Wrote:
Quote:Second, the loginconvert.php plugin needs to be activated in order to convert passwords for imported users from punBB.

I don't see this documented anywhere? Remember that the a person doing a conversion is more than likely VERY new to mybb and will need precise instructions. Even I wasn't aware it needed to be activated. I just assumed it needed to be uploaded.

There is a lack of documentation for the merge system...almost no instructions.

	echo "Warning: You should upload loginconvert.php to inc/plugins if you wish to convert passwords.<br />";

That's all it says...nothing about activating it.

That's so true. This loginconvert.php is kind of an obscure thing if you're not introduced to the concept...

What I've been doing this last hour:

- I've used BitNami WAMPStack instead of WAMPServer in case it could help and had exactly the same problems. What comes out of it is that the Merge system lacks some user output or doesn't perform enough tests on its own to be newbie-proof. The main problem is about loginconvert.php There's the "no instruction to activate" problem labrocca talked about but there's more: If the file can't be written, on some machines, there's no loginconvert.php file at all and the script does echo the warning. But if in a Windows WAMP environment, what actually happens is that a 0 byte file is created in the inc/plugins/ directory and so the script doesn't echo a thing. I can't code but I think adding a size-check would be safer. Anyway, there's a solution to this problem, it's moving/uploading the file yourself.

- It's something you're never supposed to do but I then tried to install a MyBB on a test directory on my production server (read: remote host). And I think it's a Windows NT environment (not sure) and it's supposed to be correctly configured, at least more than my local testing configuration. So, I had the warning about loginconvert.php and I uploaded it. Everything seemed to go fine again but it lead to the exact same problems. "admin" account had lost his rights, "iryx" and my other test user could only login once and then got wrong password. So, sorry Tikitiki but I feel like something *is* wrong with this Merge script. And I have no solution to this problem (yet? Wink)
loginconvert.php is part of the download and needs to be uploaded to /inc/plugins/ directory. Did you do that?
Nope, at first, as I had read nowhere that needed to do anything else but run convert/index.php. If I understood Tikitiki previous posts, the script is supposed to take care of moving the loginconvert.php and only echo if it failed. Anyway, now, to avoid any trouble, I take of uploading/moving this file myself.

As I said earlier, this problem has a clean solution - doing it yourself.
Losing the "admin" account in the process is no big deal if I can access my "iryx" admin one.
But you can only login once with converted users, which is the most urgent issue to solve I think...
iryx Wrote:But you can only login once with converted users, which is the most urgent issue to solve I think...

And I think that's solved by correctly having the loginconvert file activated and uploaded in the plugins folder.
That was an idea so I tested it, fresh install (for like the 20st time in the last 24h) and I activated the loginconvert.php plugin with the admin account before running the Merge script. But it didn't changed a thing, and after running the Merge script, remember I can only log each converted user once. So I tried logging in with "iryx" directly into the AdminCP, but this login procedure doesn't seem to use the loginconvert.php plugin because I got rejected right away. Then I made another fresh install, activate, convert and everything and logged "iryx" on the main page this time. Of course it worked but I couldn't log myself in the AdminCP after that and I still could log myself in a second time after that.

No progress here, sorry!

Just so you know labrocca, I gave Tikitiki a way to see this error by himself and analyse what's happening so I'm hoping things will get better soon.

Thanks to you two for not letting me down on this one!
labrocca Wrote:I don't see this documented anywhere? Remember that the a person doing a conversion is more than likely VERY new to mybb and will need precise instructions. Even I wasn't aware it needed to be activated. I just assumed it needed to be uploaded.

There is a lack of documentation for the merge system...almost no instructions.

There are plenty of instructions at the wiki.

labrocca Wrote:Maybe I spoke too soon..does this auto-activate it?


Quote: if(file_exists(MYBB_ROOT."inc/plugins/loginconvert.php"))
{
$plugins_cache = $cache->read("plugins");
$active_plugins = $plugins_cache['active'];

$active_plugins['loginconvert'] = "loginconvert";

$plugins_cache['active'] = $active_plugins;
$cache->update("plugins", $plugins_cache);
}

Yes. That is, it will if it's uploaded in the plugins directory (which it also trys to do automatically)

So as long as the user followed the on screen instructions, there would not be any problems.


iryx, I'll take a look in a moment. Thanks for the information.
Wow. I would have never guessing in a million years.

Apparently, this piece of code doesn't work:

if(strlen($this->user['passwordconvert']) == 40)
{
	$is_sha1 = true;
}
else
{
	$is_sha1 = false;
}

It appears since your database was converted to UTF-8, that strlen counted 2 extra characters (42) which then returned false.

So instead I used my_strlen (MyBB's built in multibyte-safe function) and it correctly returned 40 and the whole thing was fixed.

That was bizzarre. Of all my years of programming I've never seen anything like it.
This issue has been updated to confirmed bug report in the MyBB Merge System.

It has been moved to the "Bug Reports" forum.
This bug has been fixed in the latest version of the MyBB Merge System.

Please note the latest code is not live on the site or for download. An update for the MyBB Merge System will be released which contains this fix.
Pages: 1 2 3