0013152: Long password silently fails

ID	Project	Category	View Status	Date Submitted	Last Update
0013152	mantisbt	authentication	public	2011-07-18 04:16	2011-08-05 02:45

Reporter	rattkin	Assigned To	dregad
Priority	normal	Severity	minor	Reproducibility	always
Status	closed	Resolution	no change required

Summary	0013152: Long password silently fails
Description	When users resets his password and enters a longer one (22 chars), mantis accepts. User than can not log in.
Tags	No tags attached.

dregad 2011-07-18 05:59 developer ~0029186	Hello, By default, Mantis stores passwords in the DB as an MD5 hash, so the length of the user's actual password does not matter because it will always be stored as a 32-char hash. Incidentally, that is also the size of the password field 32, so I cannot make sense of a limit at 22 chars as you describe. What is the value of $g_login_method in your config_inc.php ? The only reason I can think of for the behavior you describe, is if you use PLAIN (which is deprecated) then your passwords would indeed be limited to 32 chars. In that case I strongly recommend you switch to MD5.

rattkin 2011-07-18 08:44 reporter ~0029190	My config_inc does not have anything set. In config_defaults, there is MD5, so that should be good. I tried again, using 27 char password and everything worked. I guess it must be the user not remembering the password, or my mistake. Please close this bug, Thank You!

dregad 2011-07-18 08:48 developer ~0029191	You're welcome.