[Lumiera] Trac Password Reset : probably a bug(?)

[Ichthyostega]

Am 02.09.2012 04:52, schrieb Ichthyostega:
> This issue looks like a bug in Trac (or a misconfiguration of our Trac 
> installation). When I issued a password reset, a new (random) password was
> indeed mailed to me, but obviously the password in Trac wasn't changed. I
> could log in with my old password!

Some Updates on that issue.

(1) our Trac isn't broken, it just looked to be broken during our dev meeting.
    I removed the cookie from my browser to test it and overlooked that Firefox
    automatically adds a cookie blocking rule when you delete a cookie.

(2) The observed behaviour is what is expected. The "reset password" function
    doesn't reset the password, since that would be an DOS attack vector. It
    just temporarily adds a second password, which is mailed to you and will
    be purged, in case you log in with your old password. Thus your Trac
    account is as secure as your eMail account. ;-)

(3) we used a somewhat outdated dev snapshot of the account manager plugin
    I've upgraded that to an recent dev snapshot. Unfortunately, now the
    link "forgot password" is gone. Haha!
    I've found out that Trac now seems to use an in-page login form, which
    contains that link. Alternatively, Trac still supports the login via
    HTTP auth. This is how our Trac Debian package is configured, so we
    never get at the in-page login form.

So the current situation is that we don't have a "reset password" function.
In case you lost your Trac password, please drop a mail to us admins (or post to
the ML), as we can reset the password for you at any time without problems.

I'll see if I'm able to contact the author of the account manager plugin,
since it looks for me that the removal of that "forgot password" link in
the sub navigation was intentional, but the side effect for people using
HTTP auth wasn't considered.

	Cheers
	Hermann



PS: this whole story is (again) a nice demonstration why packaging software
can't be automated but requires real people (the packager and the upstream devs)
to user their brain and talk to each other.

The life of a packager and a developer likewise consists of gazillions of such
seemingly silly minor issues. This is what keeps software running smoothly.