can't get in to my admin "Wrong email security token"

[simon5968]

Hi,

 

I had login to admin then went and updated my admin login details to what i wanted them as going foreword updated my email, username, entered my c

then current password, entered my new password, confirmed the new password and all gave success notices then logout went to log back in and know can't all i'm getting is "Wrong email security token" and can't get back in ?

Please can you help me please.

 

Simon

Edited November 27, 2023 by simon5968
update to title

[simon5968]

@Ivan Holbi why didn't the system create a new and needed email token when we change the email from within admin?

and can  osCommecer's please address this as I can't get into my site and to do a new installation will lose at lest a weeks work.

[Ivan Holbi]

1 hour ago, simon5968 said:

@Ivan Holbi why didn't the system create a new and needed email token when we change the email from within admin?

and can  osCommecer's please address this as I can't get into my site and to do a new installation will lose at lest a weeks work.

Hi Simon,

We are still checking this issue. As soon as I have more information I will let you know.

Best regards,

Ivan

[simon5968]

As a work around what if I created a admin in my test site with the same user details then went into the database then copied the token then placed it in the main site would that work?

Simon 

[simon5968]

2 hours ago, Ivan Holbi said:

Hi Simon,

We are still checking this issue. As soon as I have more information I will let you know.

Best regards,

Ivan

any update's on this as I'm awaiting on this to be able to get in to my site to be able to do any work? so this is getting urgent.

[pandrei]

4 hours ago, simon5968 said:

any update's on this as I'm awaiting on this to be able to get in to my site to be able to do any work? so this is getting urgent.

The current osCommerce version does not allow you to change the admin login.

So, your have two options:

1) Reinstall osCommerce.

2) Edit admin table, find your record and change your email to the original one in the column admin_email_address. Then your previous login will be restored.

To change your login, you have to create another admin with new email.

[simon5968]

1 minute ago, pandrei said:

The current osCommerce version does not allow you to change the admin login.

So, your have two options:

1) Reinstall osCommerce.

2) Edit admin table, find your record and change your email to the original one in the column admin_email_address. Then your previous login will be restored.

To change your login, you have to create another admin with new email.

OK, but then can i suggest on the next up date you then remove the option to be able to change it within the admin that may help.

[Jack_mcs]

On 11/27/2023 at 3:48 PM, pandrei said:

So, your have two options:

1) Reinstall osCommerce.

2) Edit admin table, find your record and change your email to the original one in the column admin_email_address. Then your previous login will be restored.

To change your login, you have to create another admin with new email.

What about when you don't have access to admin? My login was working yesterday. I tried it today and can't get in. Is the only choice to re-install? 

[simon5968]

2 minutes ago, Jack_mcs said:

What about when you don't have access to admin? My login was working yesterday. I tried it today and can't get in. Is the only choice to re-install? 

is it because you changed your login details?

[Jack_mcs]

13 minutes ago, simon5968 said:

is it because you changed your login details?

No. I haven't even touched the account details since it was installed. I was playing around with a template change when I stopped. IO tried logging in today to continue and found I couldn't. After several attempts I tried the reset option on the page but it just reloads the page and doesn't do anything.

V2 shops allowed the administration table to be cleared so a new login could be created via admin. I asked for this well over a year ago but it was never implemented, as far as I know. It is a fairly often thing to happen on older shops so being able to change the login outside of the admin is important.

[simon5968]

1 minute ago, Jack_mcs said:

No. I haven't even touched the account details since it was installed. I was playing around with a template change when I stopped. IO tried logging in today to continue and found I couldn't. After several attempts I tried the reset option on the page but it just reloads the page and doesn't do anything.

V2 shops allowed the administration table to be cleared so a new login could be created via admin. I asked for this well over a year ago but it was never implemented, as far as I know. It is a fairly often thing to happen on older shops so being able to change the login outside of the admin is important.

yep. I had to reinstall and lost a weeks worth of work (OK not as much as a fully qualified developer would of done). so am just going to reinstall again for the last time before going live and will make sure i make a second admin to cover myself if this happens again.

 

but are you getting the "Wrong email security token"?

[Jack_mcs]

1 hour ago, simon5968 said:

but are you getting the "Wrong email security token"?

No. I haven't seen that. I finally got locked out due to too many retries. I reset the count in the database to get around that but it still fails. I also have the captcha option disabled in the database but it is still showing on the page. This problem really should be a priority, in my opinion.

[simon5968]

yep, there is a workaround that would make for a good add-on that's using part of the installer to make a new admin account from outside of admin?

[pandrei]

15 hours ago, Jack_mcs said:

No. I haven't even touched the account details since it was installed. I was playing around with a template change when I stopped. IO tried logging in today to continue and found I couldn't. After several attempts I tried the reset option on the page but it just reloads the page and doesn't do anything.

You probably forgot your password.
But there really is an error when recovering the password. To fix it replace lib/backend/controllers/LoginController.php with the attached one.

15 hours ago, simon5968 said:

V2 shops allowed the administration table to be cleared so a new login could be created via admin. I asked for this well over a year ago but it was never implemented, as far as I know. It is a fairly often thing to happen on older shops so being able to change the login outside of the admin is important.

This is a very insecure feature. We deliberately abandoned it.

LoginController.php

[Jack_mcs]

5 hours ago, pandrei said:

You probably forgot your password.

No. The browser has it recorded but I also have it saved from the original email when the account was created. I tried copy/paste and typing it in but none worked.

5 hours ago, pandrei said:

But there really is an error when recovering the password. To fix it replace lib/backend/controllers/LoginController.php with the attached one.

I tried it but it still doesn't work. Using the forgotten option does go farther and I get a checkmark showing that worked. But when I tried to login it still failed. The forgotten option doesn't reset the retry count so I also got locked out and had to reset the database. But starting over after doing that still failed the same way.

5 hours ago, pandrei said:

This is a very insecure feature. We deliberately abandoned it.

Understood. I was just saying there needs to be a way to login when all else fails. The forgotten password will be a good option once it works.

[pandrei]

17 hours ago, Jack_mcs said:

I tried it but it still doesn't work. Using the forgotten option does go farther and I get a checkmark showing that worked. But when I tried to login it still failed. The forgotten option doesn't reset the retry count so I also got locked out and had to reset the database. But starting over after doing that still failed the same way.

What have been your most recent changes?

Did you change anything in the configuration files?

To investigate this issue I need an FTP access to your site.

[Jack_mcs]

6 hours ago, pandrei said:

What have been your most recent changes?

Beside the file you provided, just a theme edit.

 

6 hours ago, pandrei said:

Did you change anything in the configuration files?

No.

6 hours ago, pandrei said:

To investigate this issue I need an FTP access to your site.

I have PM'ed it.

[cjf1026]

@pandrei I imported database to a new installation and now im getting the invalid email security token error. I tried clearing the token from the database and that didn't work. How can I bypass this invalid token?

Old installation is having some issues for whatever reason so doing clean install and importing the database. I have tried both import from mysql as well as restore from admin which logged me out immediately and cannot log back in.

How can I clear or bypass this email_security_token?

I tagged you in a previous post but you can disregard because too much has happened and I do not think that store is recoverable. I plan to import database, then start carrying over theme files and reinstalling any addons that are missing. I still have the old installation if you believe you can recover it. This is a production store and it is imperative we retain the data from customer orders.

 

@rfblast

Edited January 11 by cjf1026
tagging rfblast as well

[cjf1026]

Resolved - got old installation working. Beware if ckeditor injection:

https://github.com/osCommerce/osCommerce-V4/issues/63

On 8/5/2024 at 8:27 AM, DKarr said:

Found them!   In MySql database, they are listed as pages 28, 29 & 30 in the table "information" and column 21 titled "hide" can be changed to Zero to make them visible with other pages and edited as you like.

 

On 10/6/2024 at 4:38 PM, jimdanforth said:

what version of oscommerce are you using?

 

22 hours ago, cjf1026 said:

@pandrei I imported database to a new installation and now im getting the invalid email security token error. I tried clearing the token from the database and that didn't work. How can I bypass this invalid token?

Old installation is having some issues for whatever reason so doing clean install and importing the database. I have tried both import from mysql as well as restore from admin which logged me out immediately and cannot log back in.

How can I clear or bypass this email_security_token?

I tagged you in a previous post but you can disregard because too much has happened and I do not think that store is recoverable. I plan to import database, then start carrying over theme files and reinstalling any addons that are missing. I still have the old installation if you believe you can recover it. This is a production store and it is imperative we retain the data from customer orders.

 

@rfblast