Send MediaWiki-l mailing list submissions to mediawiki-l(a)lists.wikimedia.org To subscribe or unsubscribe via the World Wide Web, visit https://lists.wikimedia.org/mailman/listinfo/mediawiki-l or, via email, send a message with subject or body 'help' to mediawiki-l-request(a)lists.wikimedia.org You can reach the person managing the list at mediawiki-l-owner(a)lists.wikimedia.org When replying, please edit your Subject line so it is more specific than "Re: Contents of MediaWiki-l digest..." Today's Topics: 1. unable to change temporary password while creating new account/resetting password (Marlon Kewaldar) ---------------------------------------------------------------------- Message: 1 Date: Fri, 22 Mar 2019 12:33:11 +0000 From: Marlon Kewaldar &lt;marlon.kewaldar(a)hz.nl&gt; To: &quot;mediawiki-l(a)lists.wikimedia.org&quot; &lt;mediawiki-l(a)lists.wikimedia.org&gt; Subject: [MediaWiki-l] unable to change temporary password while creating new account/resetting password Message-ID: &lt;c6c93ff326ab4574b93d3257c0eefaa0(a)SR-WS1-17.myhz.nl&gt; Content-Type: text/plain; charset="iso-8859-1" Hi all, We have a problem changing the temporarily password assigned by Extension:ConfirmAccount< https://www.mediawiki.org/wiki/Extension:ConfirmAccount>gt;. Because I suspect it's a more general problem so I'll post it here. The problem is that the password apparently isn't changed after submitting a new one. Use case: - After creation of the account (or resetting it via 'Forgot password') and logging in with the given temporarily password I get the message "You logged in with a temporary emailed code. To finish logging in, you must set a new password here". - I change the password (submitting 2 times a new value) - I get no error message and I'm being redirected (so successful login) to the homepage. - BUT: if I log off and try to login again I've to use the old/temporarily password, the new one is not accepted - If I repeat this (login in with the old password, enter a new one) and go directly to the Speciaal:ChangeCredentials page and change the password, log off and log in again, it works fine. In the meantime we have applied a (temporary) patch in the mediawiki-code to avoid the step for changing the temporary password. in File: /home/hz01/mediawiki/core/includes/auth/TemporaryPasswordPrimaryAuthenticationProvider.php the following is changed: protected function getPasswordResetData( $username, $data ) { // Do not reset password (workaround!) return []; /* return (object)[ 'msg' => wfMessage( 'resetpass-temp-emailed' ), 'hard' => false,//true, ];*/ } This means that the user is still obliged to change his/her password after they receive the email. Of course this is not optimal, and we would like to know: a. if there is another (official) way to step over the forced changing of the temporary password b. (Better!) is there a way to store the newly entered password? It's a black box to me. Where do I have to look for an error message? Thanks in advance for your help. Met vriendelijke groet, Kind regards, Marlon ------------------------------ Subject: Digest Footer _______________________________________________ MediaWiki-l mailing list MediaWiki-l(a)lists.wikimedia.org https://lists.wikimedia.org/mailman/listinfo/mediawiki-l ------------------------------ End of MediaWiki-l Digest, Vol 186, Issue 12 ********************************************