3029 - passwords broken for 1 out of 26 people

Status: VERIFIED FIXED

(Bugzilla :: Bugzilla-General, defect, P1)

Description

[lchiang]

I'm entering this for [e-mail] because she cannot access bugzilla.

Nbaca has tried (on different machines) to log into bugzilla.  Each time, the
login has failed.  She asked that bugzilla email her the password, which it did,
but still no luck in logging in (even w/ a copy and paste of the password from
the email!).

Can you reset nbaca's password to "netscape" so that she can log in and change
her password again?

Call nbaca at x6406 or email her to confirm since I'm entering this bug for her.

Thanks!

Comment 1

[Terry Weissman]

Damn.  Damn damn damn damn damn.

I wish I knew what was causing this.  On rare occasion, something seems
to go through and wipe out the passwords for a few people.  Just a few.

Anyway, I apologize.  nbaca, the password that bugzilla mails to you should
now work.

Comment 2

[Ninoschka Baca]

I am now able to enter Bugzilla. Thanks!

Comment 3

[Jason Robbins]

I have encountered the bug while helping to manage the bugzilla installation
on www.e-speak.net.

The problem seems to be caused by a difference in the way that perl encrypts
passwords and the way that mysql encrypts them.  In bugzilla, the initial
passowrd is encrypted by MySQL and verified against a password encrypted
in perl.  The two encrypted passwords seem not to match in cases where the
encrypted password begins with two equal characters.  Brian Behlendorf pointed
out that the rate of occurance seems to be almost 1/26.

For example, you can find a list of all people who cannot log in by using
the following query:
select login_name
from profiles
where SUBSTRING(cryptpassword, 1, 1) =  SUBSTRING(cryptpassword, 2, 1);

The solution I used was to (1) do all encryption in perl and none in mysql;
and (2) put the perl password generation logic in a loop that generates
new salt until the first two characters of the encrypted password are not
equal.

jason!

======================================================================
Jason Robbins, Ph.D.      Collab.Net is hiring open source developers!
Senior Software Engineer                    http://www.collab.net/jobs
======================================================================

Comment 4

[Terry Weissman]

Hot damn!  Someone finally figured this out!  Thank you, thank you!

Do you have the patches you mentioned available?

Comment 5

[Terry Weissman]

*** Bug 5843 has been marked as a duplicate of this bug. ***

Comment 6

[Terry Weissman]

*** Bug 16233 has been marked as a duplicate of this bug. ***

Comment 7

[Terry Weissman]

OK, I have come up with my own patch and have checked it in.

My fix causes all encryption to happen in MySQL, not in perl.

Thanks again for figuring this out!

Comment 8

[John Unruh]

Verified

Comment 9

[Dave Miller [:justdave]]

Moving to Bugzilla product

Comment 10

[Dave Miller [:justdave]]

fixing summary so nobody accidently moves this to the mozilla.org product