Question

My keyboard went out on me in the process of resetting my password, as a result i cannot log in. I initially clicked on the link to reset my password, but my email notification is down. I then had another admin reset it under their access, still no success logging in. My guess is the flag is still set to "reset" my password. So my question is how do i reset it via mysql command.

Answer 1

I don't believe there is a way to do this via SQL. Passwords are hashed, so you can't just set a password. There might be a special 'no password' character than can be used, I'll ping our customer support team and see if they know of one.

There's no password reset flag.

The administrator setting the password for you is certainly the intended solution to this problem, and that should work... please verify that they didn't make a typo or something like that.

Otherwise, the primary SQL password hack is as follows:

1. UPDATE Setting SET sValue = '0' WHERE sKey = 'fPasswordEnable'
2. All Passwords are now disabled. Log in, and 'remember me.'
3. UPDATE Setting SET sValue = '1' WHERE sKey = 'fPasswordEnable'
4. Passwords are now re-enabled, and you're logged in.

It's probably a bit heavyweight for your circumstance, though.

Answer 2

Well, technically you can set the password directly, but it's a pain...and obviously not recommended.

WARNING: Here be dragons!

FogBugz salts your password before storing it in the database. So first, you need to obtain this salt value from your row in the Person table. If you're running FB7, the salt value is the first 8 characters of whatever is currently being stored in the sPassword field for your user account. So, if your account's ixPerson were 1, you could run the following query against your FogBugz database:

SELECT LEFT(sPassword, 8) FROM Person WHERE ixPerson = 1;

Now that we have your salt, we need to hash it (along with your new password) using the MD5 hashing function. If you're comfortable sending your password across the web (or at least your temporary password), there's an online implementation here that will work for our purposes. Enter the following into the textbox there and click the "md5" button (don't include the quotes):

"[your new password][your salt]"

So, for example, if your new password were "pa$$word" and your salt value were "aabbccdd" then you would enter "pa$$wordaabbccdd" and should get back "2503ca10e0e977a40a9ed8f9cd848692" in return.

Now, take that hash, prefix it with your salt value, and update your sPassword field to reflect this.

So, to continue our example, you would now run the following query against your database:

UPDATE Person SET sPassword = 'aabbccdd2503ca10e0e977a40a9ed8f9cd848692' WHERE ixPerson = 1;

That should do it.

Be sure to change your password once you've successfully logged in!