Password recovery still fails

[dimitrist]

Continuing the discussion from Password recovery failed (invalid message-id):

SYSTEM INFORMATION
OS type and version	Debian 11
Webmin version	2.021
Virtualmin version	7.7.gpl-3
Related packages	webmin-virtualmin-password-recovery: 1.12

reasking about this, since it still fails on all of our email hosting virtualmin systems.
can’t reset user pass, while emailing existing pass works.
reset link, always returns :

Recovering Password

Password recovery failed : Invalid message ID!

[johnhe]

I confirm the problem of Invalid message ID.

Also emailing the existing password does not work as the password is a garbled line.

Also, there is no subject line in the email.

SYSTEM INFORMATION
OS type and version	Rocky Linux 8.8
Webmin version	2.021
Usermin version	1.861
Virtualmin version	7.7 Pro
Theme version	20.21
Package updates	1 package update is available

[johnhe]

Also using $DOM for a custom email does not expand out. Email just has $DOM.
Also $PASSWORD gives the same garbled password as with the default email.

[johnhe]

Also when removing the package there is a stray orange link button left with Usermin logon to /virtualmin-password-recovery/usermin.cgi that is no longer appropriate.

The orange button code line is correctly edited out of /etc/webmin/custom-lang but is not edited out of /etc/usermin/custom-lang when executing dnf remove wbm-virtualmin-password-recovery for Rocky.

Can be fixed by editing or deleting file /etc/usermin/custom-lang. Safe to delete if there is only one line in file. To edit just delete the entire line with link text.

[johnhe]

I have found the cause of the problem. The address to email to is retrieved with trailing new lines. This wrecks the email.

I have raised an issue at Fix for password recovery failure due to invalid message ID and other issues · Issue #4 · virtualmin/virtualmin-password-recovery · GitHub. If you want an immediate fix, there is a one-line work around at the link.

[dimitrist]

thanks for this, will try workaround on first chance i get, and report back…

[johnhe]

The issue has been properly fixed. I put up two PRs (GitHub Pull Requests), one PR with the workaround and the second PR which was a proper fix (also a one liner) that removed the need for the workaround. The second PR also fixed the problem of the of a remaining invalid link box in Usermin when the password recovery module is uninstalled.

Jamie accepted both PRs so the full fix will be in the next release of the password recovery module.

The full cause of the problem is that the recovery email is read from a file, along with the new line at the end of the email address. There is a line of code to remove the new line character but there was a variable misspelling. The unfiltered new line at the end of the recovery email address caused the email to corrupt with extraneous characters and text and with missing email fields.