After updating password no credentials needed to login

[jdaviescoates]

@BrutalBirdie said in After updating password no credentials needed to login:

@jdaviescoates it should work with single quotes tho even with the & char.

It doesn't. Adding single (or double) quotes makes no difference whatsoever in the testing I just did.

Hmz, scrap that. I think that was because I was simultaneously experiementing with quotes around admin too.

Wait, now I'm really confused.

Using this as a password works:

'apwwith&'

(hence why I crossed that bit out above)

But this still turns auth off completely:

'sBd@ni7fjTo2J3KGRKprGm@YXPxXh7FkJzhatxGgvKJ69gAKA^gu4zfBMYjj*Gfk62nzW@M!W8VwB*epYDtPp%QApFVELKmtwkY63LJYVv@DAsMHwxucNHYFjRxT&'

[BrutalBirdie]

@jdaviescoates
Then there is also a bug in the listmonk software itself.

You can try the referenced line of code in your shell and it should return the correct string.

export LISTMONK_app__admin_password='sBd@ni7fjTo2J3KGRKprGm@YXPxXh7FkJzhatxGgvKJ69gAKA^gu4zfBMYjj*Gfk62nzW@M!W8VwB*epYDtPp%QApFVELKmtwkY63LJYVv@DAsMHwxucNHYFjRxT&'

echo $LISTMONK_app__admin_password
sBd@ni7fjTo2J3KGRKprGm@YXPxXh7FkJzhatxGgvKJ69gAKA^gu4zfBMYjj*Gfk62nzW@M!W8VwB*epYDtPp%QApFVELKmtwkY63LJYVv@DAsMHwxucNHYFjRxT&

If the Bash does this correctly but the software has an issue, there might be a similar issue there.

[BrutalBirdie]

@jdaviescoates
So just to make it clear.
Single quotes work now, even with the & char?

[jdaviescoates]

@BrutalBirdie said in After updating password no credentials needed to login:

@jdaviescoates
So just to make it clear.
Single quotes work now, even with the & char?

Sometimes.

Using this as a password works:

'apwwith&'

But this still turns auth off completely:

'sBd@ni7fjTo2J3KGRKprGm@YXPxXh7FkJzhatxGgvKJ69gAKA^gu4zfBMYjj*Gfk62nzW@M!W8VwB*epYDtPp%QApFVELKmtwkY63LJYVv@DAsMHwxucNHYFjRxT&'

[BrutalBirdie]

@girish
Please don't JUST fix the issue, I have a trainee right now perfect task for him to start learning

I will not show him this conversation and will use this as a little benchmark for his skillset

[BrutalBirdie]

@jdaviescoates said in After updating password no credentials needed to login:

Sometimes.
Using this as a password works:
'apwwith&'
But this still turns auth off completely:
'sBd@ni7fjTo2J3KGRKprGm@YXPxXh7FkJzhatxGgvKJ69gAKA^gu4zfBMYjjGfk62nzW@M!W8VwBepYDtPp%QApFVELKmtwkY63LJYVv@DAsMHwxucNHYFjRxT&'

I will have to test this when I am at home.

[jdaviescoates]

@BrutalBirdie seems it has something to do with the % too (or perhaps that is the main culprit?)

Anyways, if I remove the % from:

sBd@ni7fjTo2J3KGRKprGm@YXPxXh7FkJzhatxGgvKJ69gAKA^gu4zfBMYjj*Gfk62nzW@M!W8VwB*epYDtPp%QApFVELKmtwkY63LJYVv@DAsMHwxucNHYFjRxT&

It works with single quotes (but not without).

But with the % included it breaks the auth even with the single quotes.

[jdaviescoates]

But then this pw works fine too:

apwwith%&

So perhaps it a combination of having % ending with & and length as well?

But it can't be that either because this also works fine:

apwwith%&apwwith%&apwwith%&apwwith%&apwwith%&apwwith%&apwwith%&apwwith%&apwwith%&apwwith%&apwwith%&apwwith%&apwwith%&apwwith%&apwwith%&

I've got to collect children from school now so will have to stop testing, hopefully @BrutalBirdie will be able to figure out what's going on!

[girish]

@jdaviescoates said in After updating password no credentials needed to login:

But this still turns auth off completely:
'sBd@ni7fjTo2J3KGRKprGm@YXPxXh7FkJzhatxGgvKJ69gAKA^gu4zfBMYjjGfk62nzW@M!W8VwBepYDtPp%QApFVELKmtwkY63LJYVv@DAsMHwxucNHYFjRxT&'

I can't reproduce this. This is what I have:

export LISTMONK_app__admin_username=admin
export LISTMONK_app__admin_password='sBd@ni7fjTo2J3KGRKprGm@YXPxXh7FkJzhatxGgvKJ69gAKA^gu4zfBMYjj*Gfk62nzW@M!W8VwB*epYDtPp%QApFVELKmtwkY63LJYVv@DAsMHwxucNHYFjRxT&'

[jdaviescoates]

@girish said in After updating password no credentials needed to login:

export LISTMONK_app__admin_username=admin
export LISTMONK_app__admin_password='sBd@ni7fjTo2J3KGRKprGm@YXPxXh7FkJzhatxGgvKJ69gAKA^gu4zfBMYjjGfk62nzW@M!W8VwBepYDtPp%QApFVELKmtwkY63LJYVv@DAsMHwxucNHYFjRxT&'

Odd. I can reproduce it over and over again.

Just did so again:

[humptydumpty]

@jdaviescoates I'm way off here but... my router's admin page auto logs me in at work if I'm signed in to my vault even though I have auto-fill disabled. Try logging in in a private window (or with all extensions disabled). It also happens to me on Costco dot com. Do you have the passwords saved in your vault?

Edit: I can't reproduce it either on a fresh install. I copied Girish's code like you did in your video. Works fine

Another thought, check Firefox's native password manager if it's still on and it's auto-filling the pass.

I can reproduce it if the code is like this:

export LISTMONK_app__admin_username=admin
export LISTMONK_app__admin_password=sBd@ni7fjTo2J3KGRKprGm@YXPxXh7FkJzhatxGgvKJ69gAKA^gu4zfBMYjj*Gfk62nzW@M!W8VwB*epYDtPp%QApFVELKmtwkY63LJYVv@DAsMHwxucNHYFjRxT&

Maybe it's a visual bug because of the double ' ' that gets auto-completed as you type ' in the web terminal at the end of the pass.

recording here: https://ufile.io/24rtfp8a (1MB).

[jdaviescoates]

@humptydumpty said in After updating password no credentials needed to login:

Try logging in in a private window (or with all extensions disabled).

Tried all that, and same in mobile browsers too.

[BrutalBirdie]

All I can say is that with single quotes all is working fine.
Tested and pushed by my trainee.

[privsec]

I am running into this myself.

I have used far more complicated combinations than the following, but I have it set
export LISTMONK_app__admin_username="Gently2729"
export LISTMONK_app__admin_password="ThemePavilionCare"

I have also tried
export LISTMONK_app__admin_username='Gently2729'
export LISTMONK_app__admin_password='ThemePavilionCare'

I am not prompted for a sign in with an incognito window

[privsec]

After many different tests, the username was the cause.

Once the username is all in lowercase, it would work.

[girish]

@privsec scary. I will test and put a warning in the docs and the config file.

[girish]

I can't really reproduce this. It works just fine with capital case usernames. I used the same creds as in the report:

export LISTMONK_app__admin_username="Gently2729"
export LISTMONK_app__admin_password="ThemePavilionCare"

[BrutalBirdie]

Maybe to reproduce this:

1. Correct Username + Broken Password
2. Same Username + Fixed Password
3. Still no login needed?

I will try this out.

[girish]

@BrutalBirdie Thanks. Also, this has to be reported upstream because this auth code is by them and not Cloudron.

[BrutalBirdie]

Could not reproduce at all.
very strange. Maybe @privsec needs to share the exact steps to this issue.