Security answer in password retrieval section doesn't work!

Welcome Guest! To enable all features please Login or Register

herman_herman
100% (Exalted)
YAF MVP Topic Starter

16 years ago

The security answer in password retrieval section does not work and keep saying "Your answer could not be verified. Please try again."

Regards

Touradg

Wanna join the discussion?! Login to your YAF.NET Support Forum forum account or Register a new forum account

Sponsor

Jaben
100% (Exalted)
YAF Developer

16 years ago

Do you know what your answer is?

herman_herman
100% (Exalted)
YAF MVP Topic Starter

16 years ago

:cheesy: kidding me..?:wink:

Jaben
100% (Exalted)
YAF Developer

16 years ago

You are using the YAF provider?

And I'm not trying to be obvious -- but maybe verify the exact answer in your database and copy and paste to see if it still fails.

Edited by user 16 years ago | Reason: Not specified

Mek
100% (Exalted)
YAF Developer

16 years ago

If its using our provider or MS's it'll be hashed. But please provide which provider you are using (pun intended)? :-)

"It's a case of RTFM.. the only problem being we don't have a manual!"

When I post FP:Mek in a topic, I'm leaving my footprint there so I can track it once I get into coding/supporting. (Yes I stole this off Ederon 🙂 )

herman_herman
100% (Exalted)
YAF MVP Topic Starter

16 years ago

Everythings default and untouched from package.I cheched the database as Jaben said and here is its screenshot.but stii it fails.as you can see only the last one (admin) is hashed!

Mek
100% (Exalted)
YAF Developer

16 years ago

Ok now I'm confused... I'll look into it 🙂 You didn't change the web.config provider hash options after you installed did you?

"It's a case of RTFM.. the only problem being we don't have a manual!"

When I post FP:Mek in a topic, I'm leaving my footprint there so I can track it once I get into coding/supporting. (Yes I stole this off Ederon 🙂 )

Ederon
100% (Exalted)
YAF Developer

16 years ago

I can confirm this, it doesn't work for me with out-of-box default settings.

When I post FP:Ederon in a topic, I'm leaving my footprint there so I can track it once I get into coding/supporting.

Jaben
100% (Exalted)
YAF Developer

16 years ago

Yeah, I noticed this... it didn't work then it did. Not sure what changed. I think it might be the provider code though.

Mek
100% (Exalted)
YAF Developer

16 years ago

#10

okay okay I get the hint 🙂 I'll sort it tomorrow.

"It's a case of RTFM.. the only problem being we don't have a manual!"

When I post FP:Mek in a topic, I'm leaving my footprint there so I can track it once I get into coding/supporting. (Yes I stole this off Ederon 🙂 )

herman_herman
100% (Exalted)
YAF MVP Topic Starter

16 years ago

#11

Ok now I'm confused... I'll look into it 🙂 You didn't change the web.config provider hash options after you installed did you?

Mek wrote:

Nop

test2005
100% (Exalted)
YAF MVP

16 years ago

#12

DOH!!!!

.....the man in black fled across the desert..........and the gunslinger followed.....

Mek
100% (Exalted)
YAF Developer

16 years ago

#13

Yeah twigged this one, it doesn't hash when it creates a user but will hash the security answer when a user changes their own password.... working on a fix but at least we have the why :-)

"It's a case of RTFM.. the only problem being we don't have a manual!"

When I post FP:Mek in a topic, I'm leaving my footprint there so I can track it once I get into coding/supporting. (Yes I stole this off Ederon 🙂 )

Mek
100% (Exalted)
YAF Developer

16 years ago

#14

k this was easy, on YafMembershipProvider.cs line 498 it called the DB.CreateUser with the unencrypted version of the passwordanswer string.. subsituting for the correct one solves the problem.

Comitted to SVN.



// Encode Password Answer
			string encodedPasswordAnswer = YafMembershipProvider.EncodeString( passwordAnswer, ( int )this.PasswordFormat, salt, this.UseSalt );
			// Process database user creation request
            DB.CreateUser(this.ApplicationName, username, pass, salt, (int)this.PasswordFormat, email, passwordQuestion, passwordAnswer, isApproved, providerUserKey);

changed to:



// Encode Password Answer
			string encodedPasswordAnswer = YafMembershipProvider.EncodeString( passwordAnswer, ( int )this.PasswordFormat, salt, this.UseSalt );
			// Process database user creation request
            DB.CreateUser(this.ApplicationName, username, pass, salt, (int)this.PasswordFormat, email, passwordQuestion, encodedPasswordAnswer, isApproved, providerUserKey);

Edited by user 16 years ago | Reason: Not specified

"It's a case of RTFM.. the only problem being we don't have a manual!"

When I post FP:Mek in a topic, I'm leaving my footprint there so I can track it once I get into coding/supporting. (Yes I stole this off Ederon 🙂 )

herman_herman
100% (Exalted)
YAF MVP Topic Starter

16 years ago

#15

Mek,

Thanks for fix.I will apply it to mine.

Important Information: