Skip to main content ↑ ↓
Topic: Lost password - cant receive reset email (Read 3047 times) previous topic - next topic
0 Members and 1 Guest are viewing this topic.

Lost password - cant receive reset email

Hello everyone.  I would lose my head if it wasn't attached.    :-[

I am the admin and proud user of a forum built with Elkarte.  I know it will send me a mail if I lose my password.  Unfortunately, the  "cheapie" host I have, apparently is not allowing scripts to send mail.

1, what do I need to tell the host?  I think its "allow sendmail" or can I allow it myself from  cPanel?  
2, is there a way for me to retrieve my password, maybe  using FTP looking at the config file?

 Congrats to all those involved in the creation of Elkarte BTW.  I have used half a dozen free forum scripts and this is by far the best.  I just removed a forum script (that's named after a milkshake flavor if you get my drift) and am using  Elkarte in its place.

Thanks
Matt
Last Edit: June 21, 2016, 07:40:15 pm by elk_is_cool

Re: Lost password - cant receive reset email

Reply #1 –

Do you have access to the database?   If so, register a second account.  In the database make it a member of group 1.  This gives it admin privileges.  Then use that account to reset your other account.  Finally, do whatever you like with the second account.  Keep it as an admin, delete it, or whatever.  I like having a second account on my forums for testing purposes.  It can assigned to various membergroups so you can see precisely what they see.  Great for troubleshooting permissions issues, etc.

Re: Lost password - cant receive reset email

Reply #2 –

Thanks badmonkey.  May try that as a last resort.  I do have full access to cPanel and DB.  Thought there was a place in phpMyAdmin where I could go in and reset it.  Or a config file.

Re: Lost password - cant receive reset email

Reply #3 –

Quote from: elk_is_cool – Thanks badmonkey.  May try that as a last resort.  I do have full access to cPanel and DB.  Thought there was a place in phpMyAdmin where I could go in and reset it.  Or a config file.

There isnt direct password access in the database.  The stored info is hashed.  Now, in theory someone could throw together all the variables, use some software to reproduce the hash, copy it into the database.  But that's more work than the first. 

Setting another user to admin privileges in the database is literally editing a 2 to a 1. Just a thought. 

Re: Lost password - cant receive reset email

Reply #4 –

OK, maybe I'll give that a try.

Re: Lost password - cant receive reset email

Reply #5 –

Hi and welcome.

Another way is to go to the members table in phpmyadmin, find your nick, edit the password_salt field, remove the value (leave it empty), in the same way change the field passwd to whatever password you want, and then login with it.

Thinking about it, this is (still) a potential surface of attack, I feel we should consider removing this "goodie".
Bugs creator.
Features destroyer.
Template killer.

Re: Lost password - cant receive reset email

Reply #6 –

Quote from: emanuele – Thinking about it, this is (still) a potential surface of attack, I feel we should consider removing this "goodie".
Doesn't make much sense, if you have phpmyadmin access, you can create an admin account and do bad things anyway :-X
~ SimplePortal Support Team ~

Re: Lost password - cant receive reset email

Reply #7 –

That's not the whole picture.
Bugs creator.
Features destroyer.
Template killer.

Re: Lost password - cant receive reset email

Reply #8 –

You could also edit other people's passwords? You can do it anyway... :/
Tell me that "whole picture" then, if it's not what you mean.
~ SimplePortal Support Team ~

Re: Lost password - cant receive reset email

Reply #9 –

For the moment it's enough that I and a handful of people with good eye for security know the whole picture.
It's not particularly wise to publicly disclose surfaces of attack even if are rather narrow and require quite a bit of things to happen at once.
Bugs creator.
Features destroyer.
Template killer.

Re: Lost password - cant receive reset email

Reply #10 –

Thanks everyone for the suggestions.  Since its a brand new forum I made, (no members yet) and I really don't know phpMyAdmin enough to be fooling around there,  I just deleted the DB and install and recreated the forum.  I sure don't want to give hackers any help on attacking ElkArte,  so DO feel free to delete this thread if you think its a good idea to do so Emanuele, or if I can delete my own thread, I will if you want me to.   Will leave it up to you all...
Last Edit: June 22, 2016, 10:32:35 am by elk_is_cool

Re: Lost password - cant receive reset email

Reply #11 –

Well, usually is better to learn a new tools (phpmyadmin) when you have the possibility to rebuild our forum from scratch.
Now you still don't know phpmyadmin and next time you may have members you can't afford to lose. ;)
Bugs creator.
Features destroyer.
Template killer.

Re: Lost password - cant receive reset email

Reply #12 –

Quote from: elk_is_cool – so DO feel free to delete this thread if you think its a good idea to do so Emanuele, or if I can delete my own thread, I will if you want me to.   Will leave it up to you all...
There is no reason to delete it. The code is there speaking for itself.
Just there are edge cases not written in the code that may very well be worth taking into account. ;)
Bugs creator.
Features destroyer.
Template killer.

Re: Lost password - cant receive reset email

Reply #13 –

Quote from: emanuele – Well, usually is better to learn a new tools (phpmyadmin) when you have the possibility to rebuild our forum from scratch.
Now you still don't know phpmyadmin and next time you may have members you can't afford to lose. ;)
VERY good point I never thought about.  If I had members, that would not have been good to do what I did.   I think its time I study up on using phpMyAdmin.