Broken password confirmation box on registration

Contribute Bug

AI-generated summary

A bug has been reported in the registration process of Discourse instances, including Discourse Meta and luftaquila’s own instance. The issue causes a password confirmation box to display strange hashes, allowing users to register without confirming their password. pmusaraj has confirmed the issue and stated that it will be investigated.

The bug has been identified as a regression in the core code, caused by a commit from the previous day pmusaraj. A fix is pending in a pull request and will be implemented once it passes testing. The issue is not specific to any device, browser, or locale, and has been reproduced in multiple instances, including https://discourse.jupyter.org/ luftaquila.

Additionally, luftaquila has discovered that the hash boxes are part of a canary logic, intended to prevent account creation issues. Editing the hash can cause the “We cannot detect if your account was created” error message. The fix for the password confirmation box issue may also resolve this related problem.

1

My discourse instance is showing some strange hashes at the password confirmation input box. I could register without changing something on that boxes.

But I suspect this is not a problem of just my installation, because I saw the same thing when I registered to Discourse Meta to write down this issue.

I couldn’t believe this is a local issue when same thing is happening in another instances. While my desktop locale is Korean, my phone has its local set to English but same thing is happeneing.

Untitled
Untitled2059×1358 206 KB

Same thing is happening in the Android Chrome on Pixel 7, but I couldn’t attach screenshot due to a new user limit.

It could be reproduced in any devices or browers.

I’m not sure if this helps, but this is an HTML element that is showing hash boxes.

<div class="password-confirmation">
              <label for="new-account-password-confirmation">
                비밀번호 확인
              </label>
              <input autocomplete="new-password" placeholder="" id="new-account-confirmation" class="ember-text-field ember-view" type="text">
              <input id="new-account-challenge" class="ember-text-field ember-view" type="text">
            </div>

I found another instance affected: https://discourse.jupyter.org/

Thank you for your help in advance.

3 Likes
2

I can reproduce this using both Korean and English. We will look into this right away.

3 Likes
4

My instance’s first member suffered from the “We cannot detect if your account was created, please ensure you have cookies enabled” message while signing up, which is accounted here: We cannot detect if your account was created, please ensure you have cookies enabled

I spent a hour reading that topic, and finally realized that the hash boxes are some canary logic. Successfully reproduced the “We cannot…” issue by editing that hash for even a character. Maybe it will be fixed too, by hiding that challenge boxes. 2-in-a-row.

I found another instance that is affected(https://discourse.jupyter.org/) and now I’m surprising about how instances could be remotely affected, even if I didn’t change things after I successfully signed up with no issue.

I’m not sure that ./launcher rebulid app automatically pulls the latest commit that broke signup, but I think I did rebuild instance to install some plugins before the issue was present. Maybe this is the cause.

8

This was a regression in core from a commit from yesterday. Should be fixed once FIX: Restore missing modal scss by pmusaraj · Pull Request #28085 · discourse/discourse · GitHub gets to the tests-passed branch.

Thanks for reporting it @luftaquila!

6 Likes