1

This question already has an answer here:

I have upgraded a local install of magento 1.6 to 1.9
the magento install is on a windows server so I can't run mage script. I upgraded manually by copy and paste the magento 1.9.1 system files replacing the old one.

I didn't expect this to work, but it did! Now that I have and upgraded version of magento I have password error for both customers and admin users.
This is not the "usual" cookie or session issue. I have understand this happens due to the different ways password are generated in magento 1.6 and 1.9: the salt is no longer 2 character string but 32.
if I manually generate a new encrypted password staring from the same old non encrypted pw value and update this in the database I can correctly login.
I made a test with this code in a getpw.php file in the magento root:

<?php
require_once 'app/Mage.php';
Mage::app();
## For magento1.7 or Earlier var
//$_HASH_SALT_LENGTH = 2;
## For magento1.8 and magento1.9
$_HASH_SALT_LENGTH = 32;
#Generate admin password 
$password = "my-old-password-value";
echo $adminPass = Mage::helper('core')->getHash($password, $_HASH_SALT_LENGTH);
?>

I run this script and then copy the new pw in the database. This work fine both for user and admin.
The issue is that I have to now the old non encrypted password and obviously this is true only for mine account.
There is a way to update all the password to the new format? I assume magento upgrade script takes care of it in some way... How can I do the same via SQL or PHP?

UPDATE:
HAs been pointed out question 70459 as a possible duplicate of this one.
I think it is not a duplicate of mine because in that case the old passwords with 2 character salt work and the updated one no. In my case it is the opposite: if I manually change the pw it update correctly, but if I don't update the user get "wrong password" error.
Moreover I don't have any database related issue in VARCHAR length like in the case of the question 70459.
I need to understand why the passwords with 2 characters salt are no more recognized and how to automatically update all the admins and customers pws with a one click script.

UPDATE 2:
I have also read the reddit post suggested in in the previously mentioned similar question. It ends whit this simple statement:

However, Magento should still correctly recognize old passwords.

So the issue I'm experiencing is a bug caused by the upgraded process. And not by a wrong configuration of a database field link in the case of the other question. I'll really appreciate any advice on how to fix this issue.

marked as duplicate by Fabian Blechschmidt, Marius Jun 10 '15 at 14:46

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • if you have now your password then why you cannot reset password. – Amit Bera Jun 10 '15 at 12:52
  • please try this require_once 'app/Mage.php'; umask(0);Mage::app('admin'); Mage::getModel('admin/user') ->loadByUsername($adminUSerName) ->setPassword($password) ->save(); – Amit Bera Jun 10 '15 at 12:56
  • about the first comment: I need to update passwords for all the customers (thousands) and I don't want customers had to reset their how pw or to notify them a new pw. I just want to make their old pw to work properly. About the second comment: your script needs I know the password to be set, am I right? – danipen Jun 10 '15 at 13:15
  • Thanks Fabian, I've updated my question to explain why it is not a duplicate of the one you pointed out. Do you have any advice? – danipen Jun 10 '15 at 14:32