View Issue Details

IDProjectCategoryView StatusLast Update
0010264mantisbtadministrationpublic2009-06-26 12:00
Reporterklessa Assigned Tojreese  
PrioritynormalSeverityblockReproducibilityalways
Status closedResolutionno change required 
OSLinux 
Product Version1.1.6 
Summary0010264: Can't successfully add and log on new accounts
Description

I just installed Mantis, added a couple of accounts, did some configuration and entry of issues and was all ready to fully use this application. I made modifications to the config_inc.php file so that e-mail was working, and... I don't know what suddenly happened but I can't log on at all, neither can any user. What happens is that you get the message "Your account may be disabled or blocked or the username/password you entered is incorrect.".

I am really desperate for answers.

I have tried the following:

I have gone into the sql back-end and manually updated the password to an md5 encrypted string of "root" for administrator default... and I can't log in.

I have sent a password reset message, which when I click it SEEMS to allow me to enter my new password twice and activate... but after I edit user, it redirects to a screen with a message that it has completed, waits for about 20 seconds, then redirects back to the same edit user account screen... and my account password doesn't work.

Within the database I'm not seeing any issue like with the account set to disabled or anything. My administrator account right now has:

enabled = 1
everything else set to 0

My two users I added are having the same problem. I can't figure out what I've done wrong. I completely can't do anything until I can figure this out.

Version 1.1.6

Here is what's in my config_inc.php:

<?php
$g_hostname = 'xxx';
$g_db_type = 'mysql';
$g_database_name = 'xxx';
$g_db_username = 'xxx';
$g_db_password = 'xxx';

$g_allow_signup = OFF;
$g_max_failed_login_count = ON;

$g_send_reset_password = ON;
$g_password_confirm_hash_magic_string = 'XXX';

--- lost password -------------

Setting to disable the 'lost your password' feature.

$g_lost_password_feature = ON;

Max. simultaneous requests of 'lost password'

When this value is reached, it's no longer possible to request new password reset

Value resets to zero at each successfully login

$g_max_lost_password_in_progress_count = 3;

#############################

Mantis Email Settings

#############################

--- email variables -------------

$g_administrator_email = 'bxxx';
$g_webmaster_email = 'xxxx';

the sender email, part of 'From: ' header in emails

$g_from_email = 'xxx';

the sender name, part of 'From: ' header in emails

$g_from_name = 'Mantis Bug Tracker';

the return address for bounced mail

$g_return_path_email = 'xxx';

allow email notification

note that if this is disabled, sign-up and password reset messages will

not be sent.

$g_enable_email_notification = ON;

We don't need to send these notifications on new bugs

(see above for info on this config option)

#@@@ (though I'm not sure they need to be turned off anymore

- there just won't be anyone in those categories)

I guess it serves as an example and a placeholder for this

config option

$g_notify_flags['new'] = array('bugnotes' => OFF,
'monitor' => OFF);

Whether user's should receive emails for their own actions

$g_email_receive_own = OFF;

set to OFF to disable email check

$g_validate_email = ( substr( php_uname(), 0, 7 ) == 'Windows' ) ? OFF : ON;
$g_check_mx_record = OFF; # Not supported under Windows.

if ON, allow the user to omit an email field

note if you allow users to create their own accounts, they

must specify an email at that point, no matter what the value

of this option is. Otherwise they wouldn't get their passwords.

$g_allow_blank_email = OFF;

Only allow and send email to addresses in the given domain

For example:

$g_limit_email_domain = 'users.sourceforge.net';

$g_limit_email_domain = OFF;

This specifies the access level that is needed to get the mailto: links.

$g_show_user_email_threshold = NOBODY;

If use_x_priority is set to ON, what should the value be?

Urgent = 1, Not Urgent = 5, Disable = 0

Note: some MTAs interpret X-Priority = 0 to mean 'Very Urgent'

$g_mail_priority = 3;

select the method to mail by:

0 - mail()

1 - sendmail

2 - SMTP

$g_phpMailer_method = 0;

This option allows you to use a remote SMTP host. Must use the phpMailer script

One or more hosts, separated by a semicolon, can be listed.

You can also specify a different port for each host by using this

format: [hostname:port] (e.g. "smtp1.example.com:25;smtp2.example.com").

Hosts will be tried in order.

$g_smtp_host = 'smtpout.mailserver.net';

These options allow you to use SMTP Authentication when you use a remote

SMTP host with phpMailer. If smtp_username is not '' then the username

and password will be used when logging in to the SMTP server.

$g_smtp_username = 'xxx';
$g_smtp_password = 'xxx';

It is recommended to use a cronjob or a scheduler task to send emails.

The cronjob should typically run every 5 minutes. If no cronjob is used,

then user will have to wait for emails to be sent after performing an action

which triggers notifications. This slows user performance.

$g_email_send_using_cronjob = OFF;

Specify whether e-mails should be sent with the category set or not. This is tested

with Microsoft Outlook. More testing for this feature + other formats will be added

in the future.

OFF, EMAIL_CATEGORY_PROJECT_CATEGORY (format: [Project] Category)

$g_email_set_category = OFF;

--- email separator and padding ------------

$g_email_separator1 = str_pad('', 70, '=');
$g_email_separator2 = str_pad('', 70, '-');
$g_email_padding_length = 28;

?>

Additional Information

I posted this in the forum, and have gotten no response whatsoever. I need some assistance on this. If there's a fee I need to pay to get assistance, fine, but I can't get past this issue.

TagsNo tags attached.

Activities

klessa

klessa

2009-03-27 02:04

reporter   ~0021229

By the way, I deleted everything, dropped the database, re-installed, and I am still getting the same issue. Clearly something is wrong, I just need some guidance on how to resolve this.

jreese

jreese

2009-03-27 14:55

reporter   ~0021238

The offending line is most likely "$g_max_failed_login_count = ON;". It should either be set to OFF or a number (like 3). Also just try setting that back to OFF and see if it fixes the problem.

In the future, if you need support, and you don't receive any help from the forum, you should use the mantisbt-help mailing list [1] to request support, or join the IRC channel [2]. This tracker should be used only for reporting problems in MantisBT.

Links that are found on the mantisbt.org's "Support" page:
[1] http://www.mantisbt.org/mailinglists.php
[2] irc://irc.freenode.net/mantishelp

Cheers

Related Changesets

MantisBT: master 3803c90c

2009-06-25 14:19

dhx


Details Diff
Anonymous accounts: fixes and doc updates

Updated documentation of configuration options relating to anonymous
access to Mantis. Fixes 0010626.

Added new user_is_anonymous function to the user API. The purpose of
this function is to check if the current user is the anonymous user
account.

Changes user_is_protected function in the user API to always return true
when the user is the anonymous user account. The anonymous user should
never be allowed to update the preferences and settings on the anonymous
account! Fixes 0010265.

Fixed a major security bug in account_prefs_reset.php that allowed
anyone to reset the account preferences of another person. Fixes 0010264.
Affected Issues
0010264, 0010265, 0010626
mod - core/user_api.php Diff File
mod - core/authentication_api.php Diff File
mod - account_manage_columns_page.php Diff File
mod - core/access_api.php Diff File
mod - docbook/adminguide/en/configuration.sgml Diff File
mod - docbook/adminguide/en/user_management.sgml Diff File
mod - account_prefs_reset.php Diff File
mod - config_defaults_inc.php Diff File
mod - core/current_user_api.php Diff File
mod - account_prefs_update.php Diff File
mod - core/rss_api.php Diff File

MantisBT: master-1.2.x f0049266

2009-06-25 14:19

dhx


Details Diff
Anonymous accounts: fixes and doc updates

Updated documentation of configuration options relating to anonymous
access to Mantis. Fixes 0010626.

Added new user_is_anonymous function to the user API. The purpose of
this function is to check if the current user is the anonymous user
account.

Changes user_is_protected function in the user API to always return true
when the user is the anonymous user account. The anonymous user should
never be allowed to update the preferences and settings on the anonymous
account! Fixes 0010265.

Fixed a major security bug in account_prefs_reset.php that allowed
anyone to reset the account preferences of another person. Fixes 0010264.
Affected Issues
0010264, 0010265, 0010626
mod - core/user_api.php Diff File
mod - core/authentication_api.php Diff File
mod - account_manage_columns_page.php Diff File
mod - core/access_api.php Diff File
mod - docbook/adminguide/en/configuration.sgml Diff File
mod - docbook/adminguide/en/user_management.sgml Diff File
mod - account_prefs_reset.php Diff File
mod - config_defaults_inc.php Diff File
mod - core/current_user_api.php Diff File
mod - account_prefs_update.php Diff File
mod - core/rss_api.php Diff File

MantisBT: master-1.1.x 3fc6ef8d

2009-06-28 07:42

dhx


Details Diff
Fix 0010264: any user could reset prefs for others

This is a backport of f004926674c3fb64402e7606fa204c4adb235093.

There were no access checks done when resetting the preferences on an
account. Thus it was possible for any logged in user (including
anonymous users, if enabled) to reset the preferences for any Mantis
user.
Affected Issues
0010264
mod - account_prefs_reset.php Diff File