[6.7.2] Can't login as root after changing password via Webgui

I was able to reproduce this bug and had the same error.

 

I'm on 6.7.2

Do not use quotes in your password.

 

And please change priority, this is not urgent.

Quote

I initially had my diagnostics folder uploaded, but it was pointed out to me there was some personal information I'm not comfortable posting publicly. I will happily provide the zip to the appropriate staff!

It would be interesting to know what type of information this was as the Diagnostics are meant to be anonymised to avoid exactly this issue.   Maybe there is some further tweak needed.

5 hours ago, bonienl said:

Do not use quotes in your password.

I think the point of this report is to complain that the webgui should give an error message and refuse to complete the change when entering a non-valid password instead of accepting it and causing a lock out condition.

8 hours ago, bonienl said:

Do not use quotes in your password.

 

Are you seriously implying that the unraid core development team doesn't know enough about accepting user input to accept quotes for a password? This is an entry-level thing guys; it shouldn't take long to fix at all.

8 hours ago, bonienl said:

Do not use quotes in your password.

 

And please change priority, this is not urgent.

Thank you for your reply, priority has been changed to minor.

4 hours ago, itimpi said:

It would be interesting to know what type of information this was as the Diagnostics are meant to be anonymised to avoid exactly this issue.   Maybe there is some further tweak needed.

The one most concerning to me was that the running list of processes leaked the VPN IP address one of my dockers is connecting to.

 

The other things were a customized Unraid server name (should be switched to tower as part of the anonymization process IMO) as well as a few share names.

3 hours ago, jonathanm said:

I think the point of this report is to complain that the webgui should give an error message and refuse to complete the change when entering a non-valid password instead of accepting it and causing a lock out condition.

This is exactly the point of the report.

 

I don't love the answer of "Don't use quotes in your password" nonetheless I agree with jonathanm that some validation that rejects invalid passwords would be nice.

Edited October 31, 2019 by MrMackShack
Changed wording to sound nicer

This has been fixed for 6.8-rc5, that is passwords can contain single and double quotes.

Something to be aware of is how white space (space and tab characters) in passwords are handled:

• all leading and trailing white space is discarded
• multiple embedded white space is collapsed to a single space character.

By contrast, encryption passphrase is used exactly as-is.

1 hour ago, limetech said:

This has been fixed for 6.8-rc5, that is passwords can contain single and double quotes.

Something to be aware of is how white space (space and tab characters) in passwords are handled:

• all leading and trailing white space is discarded
• multiple embedded white space is collapsed to a single space character.

By contrast, encryption passphrase is used exactly as-is.

I protest this decision! It is unacceptable that I can't use my niche password "                  ". 😂

1 hour ago, testdasi said:

I protest this decision! It is unacceptable that I can't use my niche password "                  ". 😂

Imagine rainbow tables full of emtpy passwords with only your year of birth at the end 😂

3 hours ago, limetech said:

This has been fixed for 6.8-rc5, that is passwords can contain single and double quotes.

Something to be aware of is how white space (space and tab characters) in passwords are handled:

• all leading and trailing white space is discarded
• multiple embedded white space is collapsed to a single space character.

By contrast, encryption passphrase is used exactly as-is.

Awesome, glad to hear it!

2 minutes ago, MrMackShack said:

Awesome, glad to hear it!

I'm not really happy with this solution because I think password handling should be same as encryption passphrase handling: what you type exactly is exactly what is used, even if you have leading/trailing spaces and/or multiple spaces in a row.  But this will require more changes than I was willing to do and test before releasing this -rc5.  At least the reported issue with quote chars in passwords is addressed.