WebUI: Password is wrong

Hello,

refering to https://github.com/rootzoll/raspiblitz/issues/3145, I currently have the exact same problem: if I go to the WebUI and enter my password A, I get the error An error occured: Password is wrong

The password is definitely the correct one. Journal output:

Jul 30 10:54:42 raspberrypi python[822]: INFO: 127.0.0.1:47570 - "POST /system/login HTTP/1.0" 401 Unauthorized

₿ /home/admin/config.scripts/blitz.passwords.sh check a "XXXXXXXXX"
# salt file exists
# hashedPasswordSalt(XXXXXXXXXX)
# first try within last minute - respond fast
correct=1

[net47]

Do you have Special characters in your password A?

Yes, a minus and a point. I now changed it to only upper/lowercase+digits and login works now. Thanks for the hint!

[ghost]

@cstenglein will we update the password policy in the WebUI to also math the old SSH ruleset of including “-._” or is this an API thing?

From a quick look at the code, I do think this is an API thing too.

It looks like the API uses the same alphanum-only regex as the WebUI when checking a password upon login.

I’ll open PRs for the WebUI and the API so that we can see if this fixes it.

Edit:

Here’s the PRs:

• https://github.com/fusion44/blitz_api/pull/141/: Should fix this issue–the user seems to already have a password (with - and/or .) but the API won’t accept it.
• https://github.com/cstenglein/raspiblitz-web/pull/418: This is related and, while probably not the cause of this specific issue, aligns the WebUI password regex with that of the Raspiblitz.