newsNews: * RESET YOUR PASSWORD * - And we're back!

 
 
Latest News
Savannah VCS Storage Maintenance Completed posted by rwp, Wed 14 May 2014 10:19:51 PM UTC - 0 replies
Savannah VCS Maintenance posted by rwp, Sun 11 May 2014 08:05:38 PM UTC - 0 replies
Savannah https SSL Certificates Updated posted by rwp, Thu 06 Mar 2014 09:11:43 AM UTC - 0 replies
Bazaar upgraded posted by mjflick, Tue 22 May 2012 02:49:11 AM UTC - 0 replies
git / cgit updated posted by mjflick, Fri 09 Dec 2011 12:13:52 AM UTC - 0 replies
[174 news in archive]

* RESET YOUR PASSWORD * - And we're back!

Item posted by Michael J. Flickinger <mjflick> on Thu 02 Dec 2010 08:02:42 PM UTC.

Your password won't work and you'll need to request a reset.

Recently we were down for a few days due to a SQL injection attack, where user account passwords were compromised.

To best protect everyone's account and project data all user passwords in the system have been reset and we've reverted
Savannah to its backup from Nov 23rd.

A more detailed postmortem will be coming shortly.

Note: due to a PHP limitation in the crypt(3) in PHP 5.2 [1], some hashes were not properly generated. The password is still secure, but we'll see about regenerating it automatically next time you login. Meanwhile, the issue is now addressed [2] and you can regenerate it right now.
[1] http://fr2.php.net/crypt
[2] http://git.savannah.gnu.org/cgit/savane-cleanup.git/commit/?id=9391f4ac107a845a24386f40fea015eeeeb1bae8

Comments:

Old password not working (posted by Pablo Rodríguez, Sat 18 Dec 2010 08:58:30 PM UTC)

Michael,

thanks for your excellent work providing hosting facilities for free software projects.

This morning, I discovered a spam comment (https://savannah.nongnu.org/bugs/?18875#comment11) to a bug I reported, so I wanted to update my subscription email address.

I tried to log in, but I had to renew my password first, since it was reset. I tried to use my old password (which is 6 characters long), but it didn't work.

I tried to set another passwords I could remember, but the system has such complex rules to accept a valid password that I could remember, so I copied the suggestion.

I will have to have my password reset next time I have to log in because of the complexity of the rules for valid passwords.

I don't know whether this is intended, but unless it is mandatory, I'd rather set my old password.

Thanks for your help,

Pablo


   

 

Back to the top


Powered by Savane 3.1-cleanup