Umbraco-cms: Save Member resets password

[Myster]

When I save a member in the back office their password is re-set.

Reproduction

Navigate to a member, open member, press save.
The green pannel appears in the Enter your password section saying the password has been reset.

I don't have any MemberService event handlers.

Note: I tried to reproduce this in an unmodified Umbraco instance, and I see a different issue.
The second time I save a member I get a validation error that the password may not be blank. which is also bad.

Specifics

URL: http://localhost:7122/umbraco#/member/member/edit/6825f768-5527-4cbc-8ea9-f0cdbbeb1158
Umbraco version 7.15.1 assembly: 1.0.7144.21656
Browser: Chrome 76
Logging on debug:

2019-09-05 10:00:00,124 [P84168/D3/T27] DEBUG Umbraco.Web.UmbracoModule - Begin request: http://localhost:7122/umbraco/backoffice/UmbracoApi/Member/PostSave.
2019-09-05 10:00:00,201 [P84168/D3/T27] DEBUG Umbraco.Core.Sync.ServerMessengerBase - Invoking refresher Umbraco.Web.Cache.MemberCacheRefresher on local server for message type RefreshByInstance
2019-09-05 10:00:00,205 [P84168/D3/T27] DEBUG UmbracoExamine.DataServices.UmbracoLogService - ReIndexNode with type: member, Provider=InternalMemberIndexer, NodeId=1424
2019-09-05 10:00:00,205 [P84168/D3/T27] DEBUG UmbracoExamine.DataServices.UmbracoLogService - AddSingleNodeToIndex with type: member, Provider=InternalMemberIndexer, NodeId=1424
2019-09-05 10:00:00,207 [P84168/D3/T75] DEBUG UmbracoExamine.DataServices.UmbracoLogService - Index created for node 1424, Provider=InternalMemberIndexer, NodeId=1424
2019-09-05 10:00:00,224 [P84168/D3/T27] DEBUG Umbraco.Core.Sync.ServerMessengerBase - Invoking refresher Umbraco.Web.Cache.MemberCacheRefresher on local server for message type RefreshByInstance
2019-09-05 10:00:00,230 [P84168/D3/T27] DEBUG UmbracoExamine.DataServices.UmbracoLogService - ReIndexNode with type: member, Provider=InternalMemberIndexer, NodeId=1424
2019-09-05 10:00:00,230 [P84168/D3/T27] DEBUG UmbracoExamine.DataServices.UmbracoLogService - AddSingleNodeToIndex with type: member, Provider=InternalMemberIndexer, NodeId=1424
2019-09-05 10:00:00,231 [P84168/D3/T74] DEBUG UmbracoExamine.DataServices.UmbracoLogService - Index created for node 1424, Provider=InternalMemberIndexer, NodeId=1424

Expected result

The password should not change.

Actual result

The password was changed to a random password.

---

_This item has been added to our backlog AB#2538_

[nul800sebastiaan]

Yikes! I can reproduce (similar) behavior in 7.15.3 when allowManuallyChangingPassword is set to true. We'll get it fixed!

For now it might be an option to set allowManuallyChangingPassword to false if you have a "forgot password" page for your members.

[nul800sebastiaan]

Weirdly: the first time you save a member, it all goes well. Then, only the second time you save them, the password gets reset. We somehow send:

    "password": {
        "newPassword": null,
        "reset": true
    },

To the server after the first save. Reloading the member after saving them helps, at that point we send:

"password": null,

So we must be wrongly populating that password property after the first submit.

[nul800sebastiaan]

Upon further investigation: hasPassword is set to true when we first load the member but when we get the member model back after saving the member it is set to false - that is where the real error comes from.

[nul800sebastiaan]

Which leads to this line of code, we set hasPassword to false when the raw password value is null

https://github.com/umbraco/Umbraco-CMS/blob/v7/dev/src/Umbraco.Web/Models/Mapping/MemberModelMapper.cs#L372

And.. yeah, that's what we do, on purpose so that we don't save it:
https://github.com/umbraco/Umbraco-CMS/blob/v7/dev/src/Umbraco.Web/Editors/MemberController.cs#L344

[nul800sebastiaan]

That wasn't it either, I think I finally found it:

https://github.com/umbraco/Umbraco-CMS/blob/v7/dev/src/Umbraco.Web.UI.Client/src/views/member/member.edit.controller.js#L136

There's a missing check to see if passwordProp.value.reset is undefined, as the last check (!passwordProp.value.reset) returns true if passwordProp.value.reset is undefined, this is incorrect and will set passwordProp.value.reset to true.

[Myster]

Thanks for sorting this out, i’m glad I’m not the only one. :)

On Thu, 5 Sep 2019 at 9:46 PM, Sebastiaan Janssen [e-mail]
wrote:

That wasn't it either, I think I finally found it:

https://github.com/umbraco/Umbraco-CMS/blob/v7/dev/src/Umbraco.Web.UI.Client/src/views/member/member.edit.controller.js#L136

There's a missing check to see if passwordProp.value.reset is undefined,
as the last check (!passwordProp.value.reset) returns true if
passwordProp.value.reset is undefined, this is incorrect and will set
passwordProp.value.reset to true.

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/umbraco/Umbraco-CMS/issues/6283?email_source=notifications&email_token=AACWTWKA5YIUU2MJQDTMLY3QIDIOTA5CNFSM4ITW6LBKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD56QOQQ#issuecomment-528287554,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AACWTWPTKP3ZEJ5QDN4KQNTQIDIOTANCNFSM4ITW6LBA
.

[elit0451]

The issue has been resolved in v7 and the fix for v8 is on the way :slightly_smiling_face:

[robertjf]

Is there an eta when we can expect this to be released into the wild? it's been 3 months now and this issue is affecting us big time.

[paulnewzealand]

Hi, this issue is closed and it says fixed in 7.5.14 but that isn't released yet - do you know when it will be?