reset password problem

This has been a commonish problem in the past, however it appears that the way password changes are managed has changed in the newest version of the WordPress core, version 4.3.

What version of WordPress are you using? Did this problem start when you upgraded today?

(I’m not a maintainer of this plug-in but I’m interested in how these core changes are going to affect me and my use of this plug-in.)

since wordpress 4.3 i get the error: lostpassword/?error=expiredkey
when i try to reset the password…..hope anyone can help me…

^ Same

^ Same. “lostpassword/?error=expiredkey” as of WordPress 4.3.

Hi, I have exactly the same problem!

My info:
Start PW Reset, click link in mail: http:/xyz.de/passwordreset/?key=US8BlaaE5FJDIPMO8Nmk&login=xyz –> redirected to: https://xyz.de/lostpassword/?error=expiredkey

Enabled DEBUG, but not content in the Debug.log, so no errors?!
Newest WordPress and TML: 4.3 and TML 6.3.12
My host: Combination: NGINX and Apache
All Cache Plugins are disabled.
The Cookie contents the right address to the password reset site.
All my entries in the DB are fine and ok (meta ids)

Do I have any other possibilities to debug etc.?

Looking forward to your help!

Thanks a lot
Matthias

This all sounds like problems related to WordPress core changes to me.

IF we don’t hear anything from Jeff the developer in a few days, I’ll take a peek at the plug-ins code and see if I can come-up with a fix.

Cheers.

Yup same issue here…

Same problem since upgrade to 4.3 .. Tried on fresh install, its still not working..

We have the same error with Reset password.
After investigating, I see that the Password hash algorithm of WP 4.3 has changed. It means the Check_password() logic also changed. But in Theme my login, the old algorithm causes this problem.

※New changes WP 4.3

$hashed = time() . ‘:’ . $wp_hasher->HashPassword( $key );

※Theme my login 6.3.12

$hashed = $wp_hasher->HashPassword( $key );

We have to wait for Theme my login new version, I think that.

Does anyone have any other ideas?

So, has anyone tired to update line 1103 in the file:

…/theme-my-login/includes/class-theme-my-login.php

from:

$hashed = $wp_hasher->HashPassword( $key );

to what star_movie_02 is suggesting:

$hashed = time() . ':' . $wp_hasher->HashPassword( $key );

Looking at the a larger subset of the class-theme-my-login.php code there is a bunch going and I’m not positive this is the real fix, but….

Best I can tell if this doesn’t work, it just will simply fail with the same error.

I just tried that, it works, but the resulting page isn’t formatted quite right. It shows the asterisk password field _and_ the new cleartext one, but without the hide button and such that WordPress has added. I’m going to run it that way for tonight, in preference to disabling Theme My Login altogether.

I’ve tried adding that change above, so now I’m not getting the expired message. But I can’t actually change a password – as I type in the confirm password box, the characters disappear so the password never matches.

but the resulting page isn’t formatted quite right. It shows the asterisk password field _and_ the new cleartext one,

Yes, but it’s not possible to enter and then confirm the new password with this malformed page. So it’s not usable.

Too bad, I was able to. My characters don’t disappear and I’m able to successfully reset a password. Perhaps some other plugin I have installed is interfering a bit. I’ve got “Force Strong Passwords” installed also, that seems suspicious.

It is “just” possible to use. I temporarily removed the extra input box (in developer tools), then copy/pasted the new password into the two fields.

But that’s not acceptable for general use, so for me it’s better to deactivate the TML plugin until an update is available.