Password in Email Field

[Kimberly]

OK, I just saw something strange with a fresh install of the latest snapshot. I went into the backend and went to users; only one there at the moment, me. I make some changes to my user profile and hit save and got a error message that my email address was invalid. I looked at the email field and sitting there is my password in plain view. I am wondering if my password got stored to that field in the database during the install instead of my email address. Have not done any tests or checks on this. We might need to check the installer code to see if maybe we slip the wrong bit in when saving out the admin stats. I think I will try making a new user through the registration form and see what happens.

[Kimberly]

OK, I forgot I had installed QP from the same snapshot to a test install so someone that is a WordPress user could look at it and see what he thought. I just checked that install and the admin user (I installed the demo content with that install) and the email field has the email address. I did not install the demo content for the other install but that should not matter.

How did my password get into the email field? I just went into the backend; was already logged in, and did not touch that field. This is rather strange. I am going to try changing the email field and see what happens. I may end getting locked out of my account.

Edit

Dang it, I should have went to the database and checked what was stored in there before changing it

[Kimberly]

It had to have been stored in the database for it to show up when I loaded up my profile in the backend. The question is what placed my password into the email field? I changed it and all is well so that might be one of those bugs that happen once in a lifetime and impossible to track down.

[leeturner]

I have never seen this happen I don't think. Did you go straight to the user profile after install or did you (or the person you were showing QP to) do anything in between. I ask to see if I can recreate it if possible.

[Kimberly]

I have never seen this happen I don't think. Did you go straight to the user profile after install or did you (or the person you were showing QP to) do anything in between. I ask to see if I can recreate it if possible.

Lee, I did two separate installs. The first was for a client that I set up QP earlier. I started to upgrade his installation but decided that I wanted to move him to a new database; my provider limits the size of a database but has upgraded the limit on the size but only for new databases. Since my client had not used the site there was no data to lose. I had already loaded the files to the server for upgrading but stopped. I deleted the config file, created a new database and then started the installation as a fresh install. It went smooth, no problems at all. I created my admin account per normal. Then I worked to include the template I had created for his site to the new install adding the widgets needed for the template. Since he will be using TinyMCE to compose posts, I upgraded to the latest release with the intent that he could use the new html5 figure. The other thing I did was that I installed ZenPhoto for him to use as a photo gallery (I know that we worked on doing that with QP but I wanted something more feature rich). I went into the settings for the blog and set the media folder to use the one for the ZenPhoto albums so that he can use any photo he uploads to his gallery in a blog post using the easy add or attach image that we now have. Last night I went in to check the operation of TinyMCE. I had not been to my user profile since setting up QP. To check TinyMCE, I needed to turn it on in my user profile so I went to my user profile and turned on TinyMCE (and decided to change the admin template); I did not give any notice to the email field. When I went to click save so I could then go see about TinyMCE, I got the flag that I had entered an invalid email address. To my surprise I saw my password there. I don't recall doing anything directly in the database; no need to change anything there directly on a fresh install; I only go to the database directly when I have something to correct that can not be done through the admin backend and it would not have been to change my email address; I would use the backend to do that.

The second install was on a different server on a different host for a colleague that is a WordPress fanatic to see the app. He wants to develop a social framework where we can pull in different solutions; such as using QP as the blogging platform; although he is set on WordPress. So I installed QP from a fresh install with demo content so he could get a good feel for QP. I checked last night and that install had the email address in the email address field.

As I said, this incident might be a once in a thousand year one and it could be that the error happened at the MySQL server and not anything to do with QP. It just caught me by surprise and changing the email address field worked and my password still worked.

[leeturner]

I guess we will just have to keep an eye on it. Like I said, I haven't seen this happen on either QP or evo for that matter. I have just had a play around in the backend of one of my installs but couldn't replicate it.