MyBB issues regarding two important forum functions
#1
Dear FreeVPS Directory & Discussion Community,

We would like to inform you about two persistent and critical issues with MyBB and our forum. These issues are very problematic as they prevent our members from recovering access to their forum accounts (password reset) and from receiving very important e-mails (notification for PMs, thread subscription, maybe in some cases even account activation e-mails). We have already opened several support requests topics on the MyBB support forum but have received absolutely zero support so far. So we tried it again and made a fresh topic visible here: http://community.mybb.com/thread-186864.html


Issue 1: Passwords from the password reset functions are not working. They are not being accepted by MyBB. No matter how often the password is being reset. Some of you had this issue and had to create second accounts to contact us to reset their original account passwords. In the meantime, if you cannot access your account, please send an email to nevil@freevps.us or chris@freevps.us (or both) and we will reset your password as soon as possible. Please note that you must send us the email from the address that your FreeVPS account is linked to (for verification).

Issue 2: A lot of e-mails aren't being sent out even though we switched to Sendgrid. A lot of people report that they don't receive e-mails with PM notifications or e-mails about posts in topics they have subscribed.


Due to the latter issue people have lost VPSs because they were inactive on the forum and didn't get the e-mail about the missing posts PM. Please note: This is not an excuse! You know from the past events when missing posts PMs are sent out. So you can login on that day (and a day before/after) and quickly check for new PMs. You cannot always rely on software to work properly.

We are very willing to work together with MyBB to solve this issues. Please forgive us for the caused inconvenience and we kindly ask you to bear with us.


Best Regards,
Administration
FreeVPS Directory & Discussion
#2
We've switched from Sendgrid to MailGun to see how a different 3rd party SMTP works out and are peforming a few tests now regarding the mail issue.

First impression so far: e-mails are being sent delayed and arrive a little late however I did receive the e-mails about two test PMs.


Now testing Elastic Mail. The MyBB Alerts plugin has been disabled as it can interfere with the mail function as in that instead of a mail an alert is being made.


Some mails are being sent out and arrive but others not (tested on Sendgrid, MailGun and Elastic Mail so far). There is a big delay til mails arrive. Sometimes it's fast and other times it's taking time.
#3
(2015-12-04, 2:27:13 am)Hidden Refuge Wrote:  Issue 1: Passwords from the password reset functions are not working. They are not being accepted by MyBB. No matter how often the password is being reset.

Tried to replicate this myself and indeed the password sent by the reset function doesn't work. Thanks to Nevil, I was able to regain access to my account.
#4
(2015-12-04, 2:27:13 am)Hidden Refuge Wrote:  Issue 2: A lot of e-mails aren't being sent out even though we switched to Sendgrid. A lot of people report that they don't receive e-mails with PM notifications or e-mails about posts in topics they have subscribed.

I've had that issue since the 1.6 days. I thought it was me at first. But every mail service I've tried had the same result. The first one seems interesting though. I'm gonna try and see for my self.
#5
(2015-12-04, 2:27:13 am)Hidden Refuge Wrote:  Issue 2: A lot of e-mails aren't being sent out even though we switched to Sendgrid. A lot of people report that they don't receive e-mails with PM notifications or e-mails about posts in topics they have subscribed.


Thank you for your efforts. Happy to see the admin is going to fix this issue.

For me, I do can tolerate if those missing notifications are just from non-admin members but I think being able to receive email notifications for important messages from admin is still essential.
#6
(2015-12-05, 4:12:02 am)try3vps Wrote:  For me, I do can tolerate if those missing notifications are just from non-admin members but I think being able to receive email notifications for important messages from admin is still essential.

It does not work like this. You cannot really specify that. You either have notifications enabled or disabled. And so they either work or not. And currently it's kinda mixed. And we're still not sure what the issue is and again absolutely zero replies/help on MyBB forum in our new thread.
#7
Well, I've looked into this a bit but I don't have a MyBB setup with mail support. However, something looked odd to me.

In file member.php at lines 1613 and 1614:
PHP Code:
        $password random_str($password_length);
        
$logindetails update_password($user['uid'], md5($password), $user['salt']); 


The generated password is first hashed with md5 and the resulted hash is saved as the password. However, when you login, the password is not hashed with md5. At least I haven't seen it being hashed. I'm going to have to spend some time testing this.

Might not be the issue but it's worth a try to remove the md5 and see if it affects anything. Because everything works just fine, I receive the reset URL I receive the generated password but when I try to authenticate with it I get an error saying that it's wrong.

I've used MyBB 1.8.6

The update_password function located in functions_user.php then calls salt_password:
PHP Code:
    // Create new password based on salt
    
$saltedpw salt_password($password$salt);

    
// Generate new login key
    
$loginkey generate_loginkey();

    
// Update password and login key in database
    
$newpassword['password'] = $saltedpw;
    
$newpassword['loginkey'] = $loginkey;
    
$db->update_query("users"$newpassword"uid='$uid'"); 

Which also runs the password through the md5 algorithm one more time.

PHP Code:
function salt_password($password$salt)
{
    return 
md5(md5($salt).$password);

#8
lets hope this is fixed soon. Also @HR you are right it is the user's responsibility to check the site regularly to see if there are any updates.
Keep up the good work!
[Image: img.php?userid=15852]
#9
Nothing yet on MyBB's side. No staff reply. A normal forum member replied and asked if it happens only when copy & paste or always (well it was more or less a suggestions to avoid copy & paste to get away from such issues).

The mail problem might be solved. If anyone isn't getting any e-mail that they should get please first check your settings and report to us.
#10
I resetted my password a while ago, and it still worked.

Though, it seems like it's an issue for everyone, so I'll see for myself.
"That but this blow
Might be the be-all and the end-all here,
But here, upon this bank and shoal of time,
We'ld jump the life to come."

-- William Shakespeare

Rest in peace, FreeVPS. The forum will be sorely missed.

My website } { GitHub } { Contact me: andrew@andrew-hong.me }





Users browsing this thread: 1 Guest(s)