1035375 - Accounts with no password can't reset their password

Status: RESOLVED FIXED

(addons.mozilla.org Graveyard :: Code Quality, defect, P3)

Description

[Wil Clouser [:clouserw]]

Back when our db was shared with the Marketplace, people would log in with Persona so the row in our users table would be made with a blank password.

If people then try to log in to AMO there is no password so it fails.  If they try to reset the password, the password reset email isn't sent because the password is invalid and django thinks it can't reset it.

I've fixed this for individuals by just setting a password for them and then asking them to re-request the password reset email.  We should set passwords for any users with blank passwords so they are able to reset their own passwords.

mysql> select count(*) from users where password="";
+----------+
| count(*) |
+----------+
|   156824 |
+----------+
1 row in set (2.38 sec)

Comment 1

[David Larlet [:davidbgk]]

Is it an option to delete these accounts instead? It will solve the current login issue by creating a new account if necessary. If accounts were only in use for mkt, there should not be any data linked to these account in amo. Thoughts?

Comment 2

[Wil Clouser [:clouserw]]

That would be fine as long as the accounts don't have anything associated with them (add-ons, reviews, collections, etc.).  In theory, they shouldn't, but we should verify.

Comment 3

[David Larlet [:davidbgk]]

It has to be done once the data from mkt is removed, otherwise it'll be harder to verify if some data is associated with these users.

Comment 5

[Philipp Kewisch [:Fallen][☁️📆]]

I'm coming from bug 1035232 with the account [e-mail]. I don't know if my password is empty for some reason, but I'm not getting any reset emails. My password used to be non-empty at least. I'd appreciate if you could do something to my account so I can access it again.

Comment 6

[David Larlet [:davidbgk]]

Philipp: your account do have a password set so you're probably not affected by that bug. Can you try again the password reset email? If that is still failing, let's resolve that on IRC.

Comment 7

[MS]

Could you please check if the password of my account (AMO username: convert2mp3_net) is empty? 
There should be a password because the login worked fine before the 8 characters validation have been introduced, but I am also not getting any reset emails.
A new account from the same domain is getting the reset mail.

Comment 8

[Wil Clouser [:clouserw]]

You both have passwords.  If you can get on IRC I can help debug.  #amo on irc.mozilla.org.

Comment 9

[Wil Clouser [:clouserw]]

Philipp has access now.  His account was on the suppression list in socketlabs so it wasn't delivering to him (too many failures to his address).  For the record, unrelated to comment 0, but happy to have it fixed. :)

Comment 10

[François Marier [:francois]]

I think I may be affected by this bug. I can't log into AMO or reset my password using [e-mail]

Comment 11

[François Marier [:francois]]

Thanks to Wil, I now have access to my AMO account.

Comment 12

[David Larlet [:davidbgk]]

I'm concerned that the last_login for these users is anterior to 2014-04-02 BUT when I check the last_login_attempt I can see that there are a lot of attempts from these users (about 5/10 per day these last days for instance). Query against prod:

mysql> select id,username,last_login,last_login_attempt from users where password="" order by last_login_attempt desc limit 100;

It looks more critical than it previously seemed to me given that we're annoying many active users. Do you confirm Wil?

Comment 13

[Wil Clouser [:clouserw]]

(In reply to David Larlet [:davidbgk] from comment #12)
> I'm concerned that the last_login for these users is anterior to 2014-04-02
> BUT when I check the last_login_attempt I can see that there are a lot of
> attempts from these users (about 5/10 per day these last days for instance).
> Query against prod:
> 
> mysql> select id,username,last_login,last_login_attempt from users where
> password="" order by last_login_attempt desc limit 100;
> 
> It looks more critical than it previously seemed to me given that we're
> annoying many active users. Do you confirm Wil?

I think the solution in comment 1 is still the right one.  We could also just set a password for anyone with a blank password and then they'd be able to reset it themselves.

A p2 would be fine, but either change is pretty quick.

Comment 14

[David Larlet [:davidbgk]]

I'm afraid about deleting users with related data:

mysql> select count(*) from addons_users where user_id in (select id from users where password="");
+----------+
| count(*) |
+----------+
|     4203 |
+----------+
1 row in set (1.17 sec)


mysql> select count(*) from personas where author in (select username from users where password="");
+----------+
| count(*) |
+----------+
|      567 |
+----------+
1 row in set (3.86 sec)

I'll go for a random password for all these users.

Comment 15

[Wil Clouser [:clouserw]]

works for me.  Thanks - this will solve a lot of one-off bugs and frustration from users.

Comment 16

[David Larlet [:davidbgk]]

https://github.com/mozilla/olympia/commit/4114a601cd711f1e7105d88d8d61a23b7eaa4f61