passwords get changed after login...

[marcnyc2001]

I am having the strangest issue.
I've upgraded from 1.3 to 1.9.1 and my password stopped working after the first login...
I then went into PHPMyAdmin and copied pasted the hash-equivalent of my password. At this point I am able to log in, but as soon as I log in the password in the database changes (I know because I reload the PhpMyAdmin page and I see the value changed without me changing the password).
Has anyone ever experienced this?
How do I fix it?

[marcnyc2001]

Bumpint this up to see fi anyone has had this issue because I honestly don't know how to fix it!

[scopemonkey]

Bumpint this up to see fi anyone has had this issue because I honestly don't know how to fix it!

I found that using phpmyadmin, I can go into the table webcal_user and modify cal_password and set the VARCHAR to length 255 and this fixed the password issue. I don't think the SQL modifications on upgrade are completing because not only did I find my cal_password was still VARCHAR(32), other modifications introduced in v1.9.0 and v1.9.5 (like certain tables and indexes) were not there as well. Perhaps I needed to do serial upgrades from 1.3.0 to 1.9.0 to 1.9.5 and then 1.9.10 since according to the file upgrade-mysql.sql, modification were introduced in v1.9.0 and 1.9.5. Making the jump directly from 1.3.0 to 1.9.10 definitely had issues.

[scopemonkey]

I too upgraded from 1.3 to 1.9.10 and am having the same issue. After the initial install I was able to login with my admin credentials. However, once I logout and try to log back in, my password changes (as seen in the user table in phpmyadmin) and all users password's hash have the same prefix of $2$12$. If I edit the user's database record and paste back in the original password md5 hash, I can log back in but it changes back with each logout. I have now tried this on two different installations on two different hosting platforms using PHP 8.4

EDIT: after reviewing other comments, it seems that the needed SQL modifications when upgrading are not happening. Looking at the upgrade-mysql.sql file the following changes are not happening (and with respect to the login password changes, it appears that it is due to the cal_passwd not being modified to VARCHAR(255)).

/upgrade_v1.3.0/
ALTER TABLE webcal_entry_categories
ADD PRIMARY KEY(cal_id);
CREATE INDEX
webcal_entry_categories ON webcal_entry_categories(cat_id);
/upgrade_v1.9.0/
ALTER TABLE webcal_import ADD cal_check_date INT NULL;
ALTER TABLE webcal_import ADD cal_md5 VARCHAR(32) NULL DEFAULT NULL;
CREATE INDEX webcal_import_data_type ON webcal_import_data(cal_import_type);
CREATE INDEX webcal_import_data_ext_id ON webcal_import_data(cal_external_id);
ALTER TABLE webcal_user MODIFY cal_passwd VARCHAR(255);
/upgrade_v1.9.1/
/upgrade_v1.9.2/
/upgrade_v1.9.5/
update webcal_entry_categories SET cat_owner = '' WHERE cat_owner IS NULL;
ALTER TABLE webcal_entry_categories ADD PRIMARY KEY (cal_id, cat_id, cat_order, cat_owner);
/upgrade_v1.9.6/
/upgrade_v1.9.10/

[craigk5n]

@marcnyc2001 @scopemonkey — scopemonkey, your diagnosis is exactly right. This was tracked as issue #567 and fixed in v1.9.16 (commit ac340e5a):

When upgrading from v1.3 without running the wizard, the cal_passwd column stays at VARCHAR(32). The MD5-to-bcrypt rehash on login was getting silently truncated by MySQL, locking users out. The fix verifies the stored hash after rehashing and reverts to the old hash if truncated.

To fully resolve this on your installs:

1. Upgrade to v1.9.16 (latest release): https://github.com/craigk5n/webcalendar/releases/tag/v1.9.16
2. Run the missing upgrade SQL manually — v1.9.16 prevents future lockouts but doesn't widen the column on its own:

ALTER TABLE webcal_user MODIFY cal_passwd VARCHAR(255);

3. Reset any user passwords that already got truncated (admin → Users → edit user → set new password), or paste a fresh bcrypt hash into cal_passwd via phpMyAdmin.

Sorry for the trouble. Going forward I'd recommend running the install wizard's upgrade path on future bumps so all the ALTER TABLE statements in upgrade-mysql.sql get applied.