Manual user addition with mismatched passwords tries to change administrator login

[gfmorris]

I ran across an error recently when manually registering a bunch of users in WP 2.0: when an adminstrator enters mismatched passwords, WP tries to change the password of the administrative user. This occurs in both 1.5.2 and 2.0.

The 1.5 behavior opens a popup window to confirm the change.

The 2.0 behavior opens a popup window to confirm the change and does an AJAX-fade that fools the admin into thinking the user account has been created when it has not been.

Here's the test case to try:

user: testcase

First: Test

Last: User

email: test@…

URL: ​http://testuser.com/

Pass: test

user

GFM

[davidhouse]

I can't replicate when creating a new user nor when I edit an existing one. Could you install the dump environment plugin at ​http://dev.wp-plugins.org/file/dump_env/trunk/dump_env.php and give us the output? This should help in resolving the bug. Thanks.

[davidhouse]

Oh, and check it isn't a plugin fouling things up by disabling them all. Thanks.

[skippy]

Using the provided testcase, I receive an error, in pink, at the top of the page:

ERROR: Please type the same password in the two password fields.

Using SVN revision 3411.

[gfmorris]

I'll work on getting this run through this weekend on both a 1.5.2 and a 2.0 install.

[gfmorris]

Hey all: Sorry to be really slow about this, but I've just not made the time lately. I installed the dump-env plugin, but I have no idea how to get the output from it. Any help you can provide would be great.

I disabled all plugins on my 2.0 install [sans dump-env], ran the test case, and got the same request to change passwords. I also got the same error that skippy noted above.

GFM

[gfmorris]

Any help here?

[MichaelH]

Can't duplicate this at 1.5.2, 2.0.1, or 2.1-alpha1 (3601). Also tried with various Options->General settings in "New User Default Role".

As expected, in 1.5.2, it displays a white screen with the message "ERROR: Please type the same password in the two password fields."

And in 2.0.1 and 2.1-alpha1, as expected, it displays the same message in a pink splash at the top of the screen and clears all the Add New User Fields.

In the end, can't create a new user if both instances of the password don't match. If both password entries don't match it warns the user to type the same password in both fields.

The same message is displayed if you try to change the password on an existing user and both password fields are different.

Also, saw no evidence of "WP tries to change the password of the administrative user."

[davidhouse]

Lack of confirmation.