Password Forget and Reset Password

[Dexus]

Hey, i have the problem, that i klick on the reset link on my mail.

But if i type my new password an click on "reset password" i allways get "Invalid token".

So i can't use my Ghost Blog now... :(

Use: Linux Server with NodeJS 0.10.31 and Ghost 0.5.0

[Dexus]

Same with 0.5.1-1 relase

[sebgie]

Hi @Dexus and welcome to Ghost!

I'm sorry but I can't reproduce the problem you are describing. Could you please give us more details about how to reproduce the problem. Useful information would include your browser version, what version of Ghost (download, Github, ...) your are using, the exact steps to reproduce the problem, your Linux version, proxy server (Apache, Nginx, ...), ...

[ErisDS]

@Dexus does your email address or password contain non-Latin-standard characters perchance?

[Dexus]

@ErisDS no emai only includes "0-9 a-z . @" characters. The password is using characters like "0-9a-zA-Z-.,_:;!".
Now the problem is gone. I dont know i open the link with a other mail client and now it was without error message. Befor i create this issue i had copy the link via console. And now open in Thunderbird/GoogleMail and all works. -.- I must say i have also request many times a new password, so that i get the working link.

[ErisDS]

We should consider any way we can make the tokens more robust when we do #3305, but as it appears to be working now I'm going to close this.

[hugo]

I'm seeing this issue on Ghost 0.5.5, using Mailgun. If I log into the Mailgun interface and copy the link from there, it works fine - Mailgun is encoding your token, which is then not being recognised[0]. Given that your config file suggests Mailgun as a transport layer, I think this needs fixing.

[0] e.g. the url
https://thisishugo.com/ghost/reset/MTQxNjUyOTY4MDcwNnxoZWxsb0B0aGlzaXNodWdvLmNvbXxzamFCbzF0eTlCWGE2eXJ2OFVyRVZvalNJSW15MGdYTjBlNW5tNkNzdEZnPQ==/
gets turned into via Mailgun's tracking redirector
https://thisishugo.com/ghost/reset/MTQxNjUyOTY4MDcwNnxoZWxsb0B0aGlzaXNodWdvLmNvbXxzamFCbzF0eTlCWGE2eXJ2OFVyRVZvalNJSW15MGdYTjBlNW5tNkNzdEZnPQ%3D%3D/

[javorszky]

Hm, yeah, that makes sense. Interesting question though: does base64 encoding the email cause this, or does Mailgun screw it up?

Let me put on my mr. fixit hat... brb.

[hugo]

The issue is that base64 encoding the token string possibly adds = symbols, which are not URL safe.

> encodeURIComponent("=")
"%3D"

Since - is a URL safe symbol but cannot appear in base64, you could simply convert all =s into -s when you send the token to the user, and do the reverse to the submitted token before doing whatever other parsing you do. If you're okay with that fix, I'll send a pull request (although it's so trivial a change you might want to just do it yourself).

[javorszky]

Nah, do it :)

[Afforess]

I am still seeing this issue, using a copy of Ghost built from Github as of today's date (git head: f438871) . I am being sent a password reset to a /reset/MTQxNzA1NjU4MDUyMnxia21jYXZveUBnbWFpbC5jb218NTZqM1pkMGZnVnljMVZURkJDNFFUNFVJZWRwSGR6bXo1bHdWcWtoeTVQUT0-/but any time I attempt to change the password it is an invalid token. I also am using Mailgun.

It doesn't seem to be browser related, I tried on both latest Chrome stable and my iPhone Safari browser.

[javorszky]

Will check it out today. I'm flying most of the day, so it might have to wait until tomorrow. If anyone else wants / can take it for a spin, do it :).

[hugo]

1. replace isn't promiscuous so it was only replacing the initial = if there were two.
2. validateToken calls generateResetToken and was getting the version with =s. However, fixing that then breaks redirection after the new password is saved. I've spend two hours trying to figure out why and have no clue.

[Dexus]

Why you do not trim (=) on generate? And pad if need?
Look https://github.com/RGBboy/urlsafe-base64/blob/master/lib/urlsafe-base64.js

[sebgie]

Sorry for being too quick on the merge button. I think we have overlooked some special cases here. + and / are also allowed base64 characters and are not escaped atm. After some reading I found this example (https://gist.github.com/jhurliman/1250118) on how to make base64 url safe. Long story short, + and / are encoded as - and _ and padding (=) is removed during transport and added again later. @thisishugo if you have time it would be great if you could rework this part, if not I'll take care of it :).

[hugo]

I should be able to work on this today.

[ErisDS]

Hi @thisishugo are you still working on this at all?

[hugo]

Unfortunately my laptop died and is with Apple being repaired, so I'm unable to work on this right now, sorry.

Sent from my iPhone

On 29 Nov 2014, at 03:33, Hannah Wolfe [email protected] wrote:

Hi @thisishugo are you still working on this at all?

—
Reply to this email directly or view it on GitHub.

[ErisDS]

@thisishugo Thanks for letting us know. @sebgie are you ok to pick this up?

[ErisDS]

Getting reports from all over that this is still pretty badly broken (forum post). It seems it only works for a very limited set of email addresses.

[ErisDS]

Seems the current issues are with account activation tokens, rather than password reset tokens

[sebgie]

That's me being a moron. I added the escape mechanisms on the server side but did not update the regex (https://github.com/TryGhost/Ghost/blob/master/core/client/routes/signup.js#L18) that validates the token in admin. The error is reproducible for email addresses that generate a reset token that needs padding (try add / remove chars from the email). I'll try to fix it, if anyone is good at writing Regex feel free to PR.

[JoshWillik]

I'm not sure if this was fixed by v0.5.6, but I'm still seeing this issue in a production blog when inviting a new user. The email is private obviously, but follows the form [email protected]

[ErisDS]

It will be fixed when I push 0.5.7 out ;)

[JoshWillik]

Fantastic, looking forward to the release :)

[JoshWillik]

I'm still seeing this issue in v0.5.7
This was a user DB carried over from 0.5.6, but I revoked and re-sent the invite.
I don't feel totally comfortable sharing the non-working hash & email publicly, could I email it to the devs somehow?

[sebgie]

@JoshWillik I really thought that we have solved the invitation problem in 0.5.7. I would like to find out what's going wrong. My email is sebastian (at) ghost (dot) org.

[JoshWillik]

I had neglected to rebuild the front-end files when upgrading. Disregard this issue; I apologize for wasting your time.