Admin Password Forced Change

I am atm being forced to change my admin password at the 90 day point. Couple of problems; I only changed to two days ago however I am still being forced in to the change.

When I login put in my username & current password it then sends me to Admin Login - Password Expired put in the old password then the new one. After a bit of messing around it sends me back to the login screen. I put in my username and the new password, however instead of letting me in to the admin pages it sends me back to the Admin Login - Password Expired screen. I have to, at this point put in my new password as the old one and choose another new password. Again after a bit of messing around I go back to the admin login screen. At this point the cycle starts all over again. I have done this 6/7 times before I have put this down. So atm I cannot do any admin work.

Any ideas please.

Just remembered; this has happened in the past and I thought it could have been the way I had installed some of the plugin's so I have removed that build and started again. Also is this in the right place for this question? Please feel free to move it if it is not. Thanks in advance.

thought it could have been the way I had installed some of the plugin's so I have removed that build and started again
What plugins do you have installed?
What php version?
and so forth

kobra:

What plugins do you have installed?
What php version?Plugins> css-js-loader
image handle 4
display logs
Encrypt master password
Glossary Of Terms Page
Wordpress
contact us
cookie-control
stock by attributes
Fast & Easy Checkout
css flyout
css3 buttons
Commentics
CAPTCHA PHP 5.5 & MySQL 5.1

Did you recently change your domain even from www/non-www or enable/disable https/SSL recently?

Personally my guess is something to do with encrypt master password... I believe the last time I worked on a site that had this installed and it was for a 1.5.3+ version, I had to do some sort of modification to the plugin so that it properly worked with the existing ZC code to handle/address this aspect but it's been a while.

mc12345678:

Personally my guess is something to do with encrypt master password... I believe the last time I worked on a site that had this installed and it was for a 1.5.3+ version, I had to do some sort of modification to the plugin so that it properly worked with the existing ZC code to handle/address this aspect but it's been a while.

I will try an remove this but one problem is I need to get in to uninstall part of the sql

adb34:

I will try an remove this but one problem is I need to get in to uninstall part of the sql

I have done this still cannot get in. Looks like I am going to have to hit the MySQL and manually remove the bits needed

adb34:

I have done this still cannot get in. Looks like I am going to have to hit the MySQL and manually remove the bits needed

Try logging in from another browser I have had this issues on chrome, but most times when I try it in IE it works. If that is the case it could be a cookie/session issue.

bislewl:

Try logging in from another browser I have had this issues on chrome, but most times when I try it in IE it works. If that is the case it could be a cookie/session issue.

I have just another computer with chrome and I still have the same problem. I have been looking in the database for > DELETE FROM configuration WHERE configuration_key LIKE 'EMP_LOGIN_ADMIN_%'; but cannot find it. Could someone help with it's location? This is part of the un-install of encrypted master password

That statement is supposed to be run as a sql statement either from your admin > tools
or from phpmyadmin

kobra:

That statement is supposed to be run as a sql statement either from your admin > tools
or from phpmyadmin

But I cannot get in to my admin to run the script. I am going to jump to the thread from this plugin. I did not realise there was I thread for this already. My bad.

Just had this posted to the thread for this plugin> lat9:

EMP has nothing to do with logging into your admin; its purpose is to allow your store's admins to use their admin-level passwords to log into customers' accounts.

You can run the uninstall for the plugin via your web-host's phpMyAdmin tool, just make sure to add any non-blank DB_PREFIX value to the name of the *configuration *table if you do.

Any other ideas? I really do not want to start again, again

bislewl:

Did you recently change your domain even from www/non-www or enable/disable https/SSL recently?

The answer to these questions is no

I have upload a backup copy of my site and I am in. I will have to wait until I have to reset my password to see if it was any of the plugin's I have put on the site.

adb34:

I have upload a backup copy of my site and I am in. I will have to wait until I have to reset my password to see if it was any of the plugin's I have put on the site.

It really seems that there is confusion between code and database...

The code accesses the database, and performs actions based on what it finds or doesn't find... If the code doesn't look in specific/particular locations (ie a plugns software has been removed) then the information that remains in the database will not cause the code to "make a decision" about what to do next. Such leftover data will merely take up space, and in some queries will take up time to be pulled into a variable.

So, if the "offending" code (which none of the plugins listed when installed correctly to a correctly built store should have any true/direct effect on the use of the password or the action that should occur after providing a new password) is removed/replaced with original code then the extra database "bits" will have no effect on the functional results, but if the code remains, then even if the applicable database bits are removed, the code may actually recreate aspects of it to "protect itself and the store".

Portions of the password system are shared for customer and admin in more recent versions, if not woven correctly, an action may go awry...

Forgot the important part of this ppost: so what was restored? Database or files? If database, then have lost all transactions from the time of the backup and now. If files, weel there is something different between the old fileset and what was replaced. Hopefully a comparison can still be made if a backup was collected before restoration. If both were replaced, well may never know, but doubt it is a database issue. If you need to force an expired password, that can be arranged.

You have asked if there are any other suggestions....

But I cannot get in to my admin to run the script
You do have phpmyadmin supplied by your host....use it to run the sql

mc12345678:

..... so what was restored? Database or files? ...... Just the files. The file were uploaded to a new folder so the suspect files are still on the server just not being used. You mention backup was collected before restoration, Please could you explain this bit.

Have you used phpmyadmin to run the sql??

kobra:

Have you used phpmyadmin to run the sql??

No. I am going to wait until the forced password change to see if uploading my backup has done the trick. If not I will run the sql then, ok?

adb34:

No. I am going to wait until the forced password change to see if uploading my backup has done the trick. If not I will run the sql then, ok?

So, going to wait possibly 89 days or perhaps do you want to force the password change? Does this mean that at the moment all else is well and good? You can login to your admin? You don't have error logs being generated on a regular basis?

adb34:

Just the files. The file were uploaded to a new folder so the suspect files are still on the server just not being used. You mention backup was collected before restoration, Please could you explain this bit.

Well, this action somewhat confuses me. "Backup was collected before restoration": when refering to restoration of files that is to mean to return to a previous state. Backup is to make a copy of existing information, and overall what I was getting at is to have/obtain a backup of the suspected problem files (or database if that too wasbeing restored) so that a proper comparison could be made between what worked and what didn't. Now though, the above says that the files were uploaded to a new folder leaving the "trouble" files intact? Sorry, but to minimize confusion need this one explained as well as how such an alternate folder is/was incorporated, what preventive action was taken to ensure further functionality, etc.... Too many possible scenarios fall out in my mind to document all possibilities.