Password encryption problem

Post here for help with installing or upgrading mojoPortal pre-compiled release packages. When posting in this forum, please provide all relevant details. You may also want to review the installation or upgrading documentation.

If you have questions about using the source code or working with mojoPortal in Visual Studio, please post in the Developer forum.

Post here for help with installation of mojoPortal pre-compiled release packages

When posting in this forum, please try to provide as many relevant details as possible. Particularly the following:

  • What operating system were you running when the bug appeared?
  • What database platform is your site using?
  • What version of mojoPortal are you running?
  • What version of .NET do you use?
  • What steps are necessary to reproduce the issue? Compare expected results vs actual results.

You may also want to review the installation or upgrading documentation.

If you have questions about using the source code or working with mojoPortal in Visual Studio, please post in the Developer forum.

This thread is closed to new posts. You must sign in to post in the forums.
4/5/2010 6:26:28 AM
F.L.
Gravatar
Total Posts 7
View Posts

Password encryption problem

Hi,
I know there are some other topics related to this but I just cant find a good way to enable password encryption/hashing.

Everytime I enable either one mojoportal just updates the flag in the site table but never the password in user table.

This means that the site setting is in encryption mode but the passwords are still in plain text.

Can someone, that got this working, please write a basic how-to in which order to do this.

Login with admin account, change to encryption = still plain text

Login with admin account, change to encryption, change password = cannot change password message

Login with admin account, change password, change to encryption = still plain text

Is there a way to manually run a stored procedure or similar to encrypt the passwords?

 

/F

 

4/6/2010 12:05:05 PM
Joe Audette
Gravatar
Total Posts 18439
View Posts

Re: Password encryption problem

Hi,

I confirm this as a bug. It had been reported previously and I thought I had fixed it before but yesterday I investigated it again and found it still had a bug in the change password format routine.

This is fixed now in svn trunk and will be fixed in the next release of mojoPortal.

Unfortunately there is not a way to do it manually from SQL because we use a .NET method for the encryption and it relies on the machine key of the web app.

Thanks,

Joe

4/6/2010 1:28:05 PM
Joe Davis
Gravatar
Total Posts 2239
View Posts

Re: Password encryption problem

Hi Joe,

Would it be possible to have the mojoPortal Task Queue system encrypt the passwords for all current users after this setting has been changed?

I understand that this is something that shouldn't be changed on a whim and I know that the best practice is to set the password storage option prior to adding users. The "issue" is that so many people do not realize they should change this option from clear text until after they have users.

Thanks,
Joe D.

4/13/2010 8:25:30 AM
Joe Audette
Gravatar
Total Posts 18439
View Posts

Re: Password encryption problem

This is now fixed in mojoPortal 2.3.4.2.

Best,

Joe

4/13/2010 8:42:14 AM
F.L.
Gravatar
Total Posts 7
View Posts

Re: Password encryption problem

Great!

If you installed the current version using the Microsoft Web Platform installer, what´s the best way to upgrade?

4/13/2010 8:50:35 AM
Joe Audette
Gravatar
Total Posts 18439
View Posts

Re: Password encryption problem

Hi,

Unfortunately you can't use the Platform Installer to do upgrades so you'll have to do manual installation. It is really just a mater of copying the new files over the old ones, restore any customizations to the new Web.config, then visit /Setup/Default.aspx

See upgrading from previous versions for more details.

Hope it helps,

Joe

You must sign in to post in the forums. This thread is closed to new posts.