0

I am an amateur when it comes to PHP or drupal but i have tried my best to create my own press release site. I have finished everything but while testing it out I found a stranger error.

I use 2 browsers at same time (one is the admin and other is the test user to see if the settings for those are right). When I logged out the test user to see if the necessary blocks are not showing up I experienced a strange error where I could not login again as the system says "Sorry Unrecognized Password/username". So i was forced to change the password via "Request Password" and when i clicked on the temp link in the e-mail I was able to login to the system. But when i chose to logout and login again it keeps showing the same error.

It's the same case for my admin account as well as i tried to logout that account only to be logged in by using the "request password" option

I have tried it a few times now and I am not sure whats the issue is. I would like you professionals to help me out as it is the only bug I am experiencing right now which is delaying my site launch.

Thanks in advance!

1 Answer 1

0

As this is not a direct question and is to vague to give an answer to I will supply steps that I would generally follow if I was debugging this problem.

I'd take a look at the users table for the user in question. Take a copy of the 'pass' field for the user in question and follow your steps noting the times in which this password changes. If the password changes at any point and then reverts back to a different one then it would seem something is changing this. I'd look over other users to see if this was also effecting more than one user.

I'd look through the codebase, potentially start within the 'sites' folder, looking for any instance of 'user_load(', 'global $user', '$GLOBALS['user']', '$user->password', '$account->password', 'user_save('.

I'd then read around the code where this is in place looking out for certain instances that look irregular. A favourite of mine when reviewing other peoples' code is single equal sign in a if statement. These are hard to spot and with a global of the user above the if statement with user_save knocking around the place.

An alternative but smaller feeling was the exploit within drupal 7 versions prior to 7.32 as explained here: https://www.drupal.org/SA-CORE-2014-005 There could be a chance, relatively small, that the user in question is the target of an sql exploit and the password 'reset' or change could be related to this. This would be one of the last things I would check though.

Make sure you're running up to date drupal and contrib modules though either way.

2
  • Thanks so much for your help. I just upgraded the core to 7.34 and everything seems fine!!
    – Kathir
    Nov 20, 2014 at 14:37
  • Great, can you make sure you except the answer ;) Nov 20, 2014 at 17:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.