Site Updates Main Database: Forgotten Password Requests Fixed

I believe we've managed to fix a long-standing (and very complicated) bug with forgotten password requests not correctly activating new passwords.

@Lank72, would you mind trying again please to confirm everything's now working?

 

[Lank72]

Hey thanks for looking into this

I managed to:
- Receive a 'forgotten password' email this time
- Got the temp password
- Managed to login via my phone's web browser
- Changed my password

Outstanding issues I'm seeing are:
1. My account now shows as 'unverified', though I have been through the veritifcation process before (uploaded a prescription copy etc)
2. When I then try and login to the main site via my pc browser using the new password it says that the email / password combo is incorrect

 

[Lank72]

Ah wait sorry, I don't think the change of password worked, which is why I couldn't log into the site on pc with new password

I can still login with the temp password, on phone and pc, but trying to change it doesn't seem to work.

 

[Muiredach]

Thank you, leave it with me and I'll investigate properly tomorrow and also try patch up the change password activation - I'm assuming at the moment it's a similar bug to activating temporary passwords.

 

[Muiredach]

Just did some initial testing, the password change should happen immediately and redirect to the login page thereafter.

Can you try again please @Lank72?

 

[Lank72]

Still not working for me.

I've tried changing it twice, including logging out, logging back in to a fresh session and then trying to change it.

There is no confirmation message, and the new password is not accepted (still using the temp password provided by the system)

Image below is what the screen looks like after password change is attempted:

 

[Muiredach]

Thank you, I should have now properly fixed the issue with redirecting to login before the password change. Also stopped it from forcing the need to log out afterwards.



Third-time lucky?

 

[Lank72]

 

[Muiredach]

Whey, glad to see it

 

[Lank72]

Third time lucky

Managed to log back in with new password


Only issue outstanding now is that my account is showing as 'unverified' although I have previously completed the process (I remember it was green and 'verified' next to my username)

 

[Muiredach]

Only issue outstanding now is that my account is showing as 'unverified' although I have previously completed the process (I remember it was green and 'verified' next to my username)

We're massively behind in general and are set to announce some changes to how the system works.

I'll manually go look up and sort your verification now

EDIT: All sorted @Lank72.

 

[Lank72]

We're massively behind in general and are set to announce some changes to how the system works.

I'll manually go look up and sort your verification now

EDIT: All sorted @Lank72.

Do I do need to do something to see the update, or wait a little?

It still shows as unverified my end

In case it's relevant, I have a different username on the main site?

 

[Muiredach]

Do I do need to do something to see the update, or wait a little? It still shows as unverified my end

Should have been updated when I dumped the site cache a couple of minutes ago.

In case it's relevant, I also have a different username on the same site?

I did spot the second account and deleted it, two were signed up one after the other initially - so I checked which was most recently active, and deleted the other.

 

[Lank72]

Should have been updated when I dumped the site cache a couple of minutes ago.


I did spot the second account and deleted it, two were signed up one after the other initially - so I checked which was most recently active, and deleted the other.

Yes sorry, that will be me making a mess of things forgetting I'd already created one or something (ADHD). And then subsequently forgetting my password for the one I managed to get verified!

I'm seeing it as verified now Appreciate your attention in resolving both my personal issues (as if!) and the wider password re-set for the site


As a very low priority side-note, is it possible for a user to change their username on the main site? I guess I'd not considered reviews at the time I signed up to the forums, but it would be handy for people to know which reviews correspond to the Lank72 they're used to seeing on the forum

If it's an email job for you to correct, I'm happy to send that through and let you get to it when you can

 

[Muiredach]

As a very low priority side-note, is it possible for a user to change their username on the main site? I guess I'd not considered reviews at the time I signed up to the forums, but it would be handy for people to know which reviews correspond to the Lank72 they're used to seeing on the forum

Yes, I don't think we'll offer the functionality right on the site (we disabled it here on the forum as names were changing often, and we have to manually backdate tags for each post) - but it can be manually done when necessary.

I'll get your alias there changed over to @Lank72 too momentarily

In general I'm trying to plan through an ability to 'link' accounts - so when posting reviews on the main site, there's extra stats for the user if they're also on the forum.

 

[Moon]

In general I'm trying to plan through an ability to 'link' accounts - so when posting reviews on the main site, there's extra stats for the user if they're also on the forum.

That would be cool, but could it lead to real identity hacks letting the forum DB access the main site DB?
Can you please confirm who now has access to our real identities on the main site? I have joined it to do the bud reviews, but i was concerned about sharing my real identity, even though i am now legal i keep that to myself.

 

[Moon]

@Muiredach the main site now longer knows me by email or username? done a forgot password got nothing. 3 failed attempts now via email and username, made my account last week with no problems. username Moon

 

[Muiredach]

That would be cool, but could it lead to real identity hacks letting the forum DB access the main site DB?

Not the way it's currently planned to be implemented, emails will need to match in order to allow pulling up details on the main database - and those details are already public on the forum already (post count, likes etc.) There won't actually be any ability for either site to affect the other.

Can you please confirm who now has access to our real identities on the main site? I have joined it to do the bud reviews, but i was concerned about sharing my real identity, even though i am now legal i keep that to myself.

Just me solely at the moment. Volunteers can't access any records containing 'special category' data (as defined under GDPR), or any user details in general. Previously Dr. Tahzid Ahsan has offered to help validate accounts each day (it's a big job), though this never got going. I've always been of the opinion that anyone whom has access to user/patient records whatsoever would have to be under a strict legal contract, with necessary reasoning to even access a particular account.

@Muiredach the main site now longer knows me by email or username? done a forgot password got nothing. 3 failed attempts now via email and username, made my account last week with no problems. username Moon

This might be due to a mistake I made last week, we deleted over 17,000 bot scam registrations from the site - but 8 extra genuine were caught and accidentally deleted, and permanently deleted too so I couldn't then easily go and contact accounts to notify them. It was several accounts that registered early to mid last week IIRC.

Apologies here, it is entirely my own mistake - and I assume affected your account.

 

[Moon]

Apologies here, it is entirely my own mistake - and I assume affected your account.

No worries, I will remake it now. I feel safe now over identity having read your replies, cheers

 

[Moon]

@Muiredach "Your registration was automatically blocked by our spam filter. If this registration was genuine, please email: access@medbud.wiki"
email sent.