helpSavannah Administration - Support: sr #109310, Loophole Creating Account


sr #109310: Loophole Creating Account

Submitted by:  None
Submitted on:  Thu 11 May 2017 06:05:09 AM UTC  
Category: NonePriority: 5 - Normal
Severity: 4 - ImportantStatus: Need Info
Assigned to: Bob Proulx <rwp>Originator Email: -unavailable-
Operating System: NoneOpen/Closed: Open

Add a New Comment(Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Fri 12 May 2017 10:12:42 AM UTC, comment #1:

I have manually activated your account. The account is active. Which means that you should be able to log in using the password you set previously. If not then you should be able to trigger the lost password recovery process.

There is definitely some bad interaction with Lastpass. Yours is an additional report of a problem when using Lastpass. At the moment we don't know what the bad interaction is however. I believe Lastpass should work okay with the Savannah site because Savannah's login forms are very old-school and should be okay to use with Lastpass.

Accounts are "PENDING" until the email address has been confirmed. But this is a little bit of a circular dependency for triggering the lost password recovery routine since that part will only recognize "ACTIVE" accounts. Since it is pending it just isn't active.

One can't create an additional account on top of an existing account. There isn't any code to handle that case.

In any case your account is now activated. You should be able to log in now. Please let us know if you are now able to login. I think you should be able to do so. If you need to trigger the password recovery please let us know that too. I will leave the ticket open hoping to hear back from you on your login success.

Bob Proulx <rwp>
Site AdministratorIn charge of this item.
Thu 11 May 2017 06:05:09 AM UTC, original submission:

I cannot login with my user name (important name for me).
I used my "Lastpass" program to generate the initial password while creating the account. I depended on Lastpass to create a login entry in its database or at least remember the generated password but it did not this time.

So after I verified, via the emailed link, I went to do the "Forgot Password" process. This is possible on every other account authorization scheme I have ever seen. "Savannah" will not allow me to reset the password for this account because it is "pending". I also cannot start over and create a new account with my login name since it is already there.

I am in limbo. I have an account that I forgot the password to and I am permanently locked out.

Why does the login process lock me out of being able to reset the password? I never heard of that before. What is this extra validation protecting against?

Why am I not able to create an new account over the old one ESPECIALLY when using the same username AND email address?

Rick Johnson
631-921-8450 (mobile)



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -unavailable- added by rwp (Posted a comment)
  • -unavailable- added by rwp

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.


    Please enter the title of George Orwell's famous dystopian book (it's a date):



    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 12 May 2017 10:12:42 AM UTCrwpStatusNone=>Need Info
      Assigned toNone=>rwp
      Carbon-Copy-=>Added -unavailable-

    Back to the top

    Powered by Savane 3.1-cleanup1