osCommerce - customer error on new password

[Karl Richards]

Have had several customers forget their passwords and use the "forgotten password" link on osCommerce which emails them a six character alpha numeric password which they get the the following message when they apply it.:

"Error: No match for E-Mail Address and/or Password."

I tried it myself by making up a dummy account and I get the same results. If anybody has a fix or experienced this problem I would greatly appreciate a reply.
Thanks,
Karl

[michael_s]

Most likely, if you are using copy/paste, you have an extra blank character at the end of the password.

[Karl Richards]

Micael,
Thanks for your reply!
I did look at that issue and carefully hand typed it in as well with the same results. Weird thing is it accepts the origonal password on my dummy account ?

[michael_s]

That means it is not resetting your password at all. Something is wrong with your installation. Are you using standard osCommerce?

[Karl Richards]

Yes Michael, v2.2 rc1. I was kinda thinking along the same lines and was taking a look at some php files specifically the password_forgotten.php file.
Wish I knew more. I am finding available documentation some what general in nature?
The web host tech people say they tested and found no problems? I am using Firefox 3.6 and tried this on several PCs with the same result. I thought the customers were doing something wrong at first.

[Karl Richards]

I found out you cannot put an alternate email address to send the new password to or the new password will not work. It has to be the email address used to setup the account originally. Does this makes sense or am I blowing steam?

[ridexbuilder]

That is how the system works - otherwise what's to stop anyone resetting your password

[Karl Richards]

True, came to that conclusion once I realized the security concerns.
Thanks for your input