A few hours ago I had some trouble logging into our
bug-tracking system. Of course there was no real problem, I just forgot my passwort and I've never logged into it from this computer, so there was no password-manager to assist me. Even worse, I could not use the
"I'm so stupid, I forgot my password, please email me a new one"-Button because my mailserver has hanged since the day before and my provider hasn't fixed the problem, yet.
So I decided to use my shell-account, open, run the mysql-client and search for the password in the database.
Finding the database useb by bugzill was no problem, but there was no "user" table! I took another few minutes to ascertain: there where lots of tables, a "groups"-table, a "user_group_map" and so on. But
no table named "user" or something similar.
I could not believe, that bugzilla may work without a "user"-table, so I asked my friend to log into bugzilla.
As I assumed, he could not log into bugzilla, too! My fears became true - somehow the user-table of bugzilla was removed. Maybe by an SQL-injection-attack from some bad guys, maybe by a terrible bug in bugzilla or maybe by one of the system's administrators who droped this table by accident.
It took some time searching for a file containing the SQL-statements used during the installation of bugzilla that initializes the database-structure. Later we decoverd a table in the existing database. This table is called "profiles" and contains all the data we expected in the non-exiting table "user"!
Logging in bugzilla was quit easy after changing my password stored this table. But my friends still seemed to be in trouble. He had not forgotten his password, but he also could not to log in. Once again, we updated his password in the database - without success. Finally we recognized, that he tried to access with his user-name and password instead of his email-address and password.
Shortly after solving this problem, we realized once more:
usually the bug is in front of the screen.
