helpSavannah Administration - Support: sr #109310, Loophole Creating Account


sr #109310: Loophole Creating Account

Submitted by:  None
Submitted on:  Thu 11 May 2017 06:05:09 AM UTC  
Category:  None Priority:  5 - Normal
Severity:  4 - Important Status:  Done
Assigned to:  Bob Proulx <rwp> Originator Email:  -email is unavailable-
Operating System:  None Open/Closed:  Closed

Add a New Comment(Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


( Jump to the original submission)

Sun 22 Apr 2018 12:30:53 PM UTC, comment #6:

I've just pushed and installed a commit explaining what the confirmation email looks like and where it comes from.

Ineiev <ineiev>
Site Administrator
Mon 16 Apr 2018 07:41:36 AM UTC, comment #5:

> The "INVALID.NOREPLY" sender didn't encourage me to pay attention to the verification email.

We could warn new users about it and tell them what the email is going to look like. Do you think that would help?

Ineiev <ineiev>
Site Administrator
Tue 10 Apr 2018 04:15:09 AM UTC, comment #4:

Yours was not the only Lastpass user that reported problems. There were several all at one time. Seemed suspicious.

The design is that pending accounts should be deleted after 36 hours or 3 days or some similar time that I don't recall at this moment. But in theory pending accounts that are not activated within that time are discarded and then allowed to be registered new again. At that time a new email is sent out. Something does appear to be broken there however.

The web interface has been running on inertia for a while. It could definitely use some help from someone who enjoys dealing with old PHP code. As with many projects like this I will say, patches welcome!

Bob Proulx <rwp>
Site AdministratorIn charge of this item.
Tue 10 Apr 2018 01:58:59 AM UTC, comment #3:

Hi Bob, or TWIMC

This is definitely NOT "some bad interaction with Lastpass". I only mentioned LastPass to indicate that I had certainly gotten my username and password correct.

I am guilty for missing the idea of an email verification or forgetting about it after the email took too long and I moved on with my life. I also managed to archive the verification email.
The "INVALID.NOREPLY" sender didn't encourage me to pay attention to the verification email.

I was correct in wanting my ONE username, as this site has significant discussion activity.

My (mis)use-case is valid.
The site should NOT put a new account username/password into a PENDING purgatory. I suggest the login rejection of an attempt that actually has the right credentials include the message that reminds about the email verification, for instance, "Perhaps you have missed the emailed verification link?".

Also, consider the case where the initial attempt is sent to you with a typo in their email. Is that covered?

And the database of PENDING credentials should time out and be purged at some point... a day, a month, or the minimum delay consistent with your defense against bots.

Rick Johnson -- RickJohn57
631-921-8450 (mobile)

Rick Johnson <rickjohn57>
Mon 09 Apr 2018 07:30:35 PM UTC, comment #2:

It's been a year and haven't heard back. Closing this ticket.

Bob Proulx <rwp>
Site AdministratorIn charge of this item.
Fri 12 May 2017 10:12:42 AM UTC, comment #1:

I have manually activated your account. The account is active. Which means that you should be able to log in using the password you set previously. If not then you should be able to trigger the lost password recovery process.

There is definitely some bad interaction with Lastpass. Yours is an additional report of a problem when using Lastpass. At the moment we don't know what the bad interaction is however. I believe Lastpass should work okay with the Savannah site because Savannah's login forms are very old-school and should be okay to use with Lastpass.

Accounts are "PENDING" until the email address has been confirmed. But this is a little bit of a circular dependency for triggering the lost password recovery routine since that part will only recognize "ACTIVE" accounts. Since it is pending it just isn't active.

One can't create an additional account on top of an existing account. There isn't any code to handle that case.

In any case your account is now activated. You should be able to log in now. Please let us know if you are now able to login. I think you should be able to do so. If you need to trigger the password recovery please let us know that too. I will leave the ticket open hoping to hear back from you on your login success.

Bob Proulx <rwp>
Site AdministratorIn charge of this item.
Thu 11 May 2017 06:05:09 AM UTC, original submission:

I cannot login with my user name (important name for me).
I used my "Lastpass" program to generate the initial password while creating the account. I depended on Lastpass to create a login entry in its database or at least remember the generated password but it did not this time.

So after I verified, via the emailed link, I went to do the "Forgot Password" process. This is possible on every other account authorization scheme I have ever seen. "Savannah" will not allow me to reset the password for this account because it is "pending". I also cannot start over and create a new account with my login name since it is already there.

I am in limbo. I have an account that I forgot the password to and I am permanently locked out.

Why does the login process lock me out of being able to reset the password? I never heard of that before. What is this extra validation protecting against?

Why am I not able to create an new account over the old one ESPECIALLY when using the same username AND email address?

Rick Johnson
631-921-8450 (mobile)



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by ineiev (Posted a comment)
  • -email is unavailable- added by rickjohn57 (Posted a comment)
  • -email is unavailable- added by rwp (Posted a comment)
  • -email is unavailable- added by rwp

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-04-22 ineiev StatusNeed Info => Done
    2018-04-09 rwp Open/ClosedOpen => Closed
    2017-05-12 rwp StatusNone => Need Info
        Assigned toNone => rwp
        Carbon-Copy- => Added -email is unavailable-

    Back to the top

    Powered by Savane 3.4