Password.txt is NOT used.
Description
Environment
Running locally on Workstation
Windows 11
Lucee 5.4.6.9
Light and FAT jar - both affected.
Using CommandBox and CFConfig
Activity
Zac Spitzer 11 February 2025 at 10:41
The ability to use password.txt is only available when there is no password defined in your CFConfig.json
for backwards compat, in addition to hspw there are additional fields checked for a password, adminDefaultPW adminPWand adminDefaultPassword adminPassword
I also can’t reproduce this, using windows sandbox I had a world of problems with commandbox 6.1 (but that’s another story, installer didn’t work, server stop timing out calling cfexecute )
So back to your issue, just creating a password.txt once those values are set, will do nothing
Can you try with 6.2.0.318-SNAPSHOT (or similar), taking copies of your .CFconfig.json between steps and post back here any diffs for the above variables between those steps?
Keep in mind, changes in the .CFConfig.json are only polled every 60s when checkForChanges is enabled, otherwise, changes won’t be applied until after a restart
https://docs.lucee.org/recipes/check-for-changes.html
when enabled, you’ll see the following log entry within 60s, if you modify the context .CFConfig.json file
alternatively, since 6.1.1 you can just drop a .json containing any CFConfig directives (i.e. the snippets above etc) into your deploy directory and it will be imported (merged) automatically ever 60s
Gavin Baumanis 11 February 2025 at 02:10Edited
I retried - using 6.1.1.118
This issue is NOT resolved.
I have deleted the ./Commandbox directory and restarted the server.
I then created a password.txt file.
I then restarted the server with (box) server stop / server start
The password.txt file is NOT imported - it remains in the lucee-server/context directory
Pothys - MitrahSoft 7 January 2025 at 15:25
, I investigated this ticket using Lucee version 6.2.0.272-SNAPSHOT with CommandBox. When I tried to set the Lucee admin password through CFConfig, it worked as expected. Additionally, when I set the dotenv variable LUCEE_ADMIN_PASSWORD in CommandBox, it worked fine in the Lucee Server Admin. No issues were encountered, and it functions correctly in the latest version of Lucee.
Michael Offner 6 January 2025 at 15:51
how does the browser cookie have any effect on this?
In the end it is very easy in Lucee 5, Lucee looks for the password in the lucee-server.xml, if that is not set, Lucee will give the message about the password.txt on the login page and when you click “import“ it will read the txt file and set the password.
reading the description from above it seems, a maybe empty password is set in the XML.
the only change on this in Lucee 5, is that we added support for the env var “LUCEE_ADMIN_PASSWORD“ (read more here ) that will bypass the password.txt.
can you check if that is a regression not happening with older versions?
Please also check how the lucee-server.xml looks like, that is the only thing that count, when the env var “LUCEE_ADMIN_PASSWORD“ is not set.
Pothys - MitrahSoft 23 December 2024 at 14:32
, I investigated this ticket using Lucee version 5.4.6.9-SNAPSHOT and 6.2.0.249-SNAPSHOT with CommandBox. When I tried to set the password using the config set adminPassword=myPassword toFormat=luceeServer command, the password was generated in the CommandBox.json file, but the Lucee admin password was not updated. This appears to be a valid bug.
However, when I created the password.txt file in the lucee-server/context/ directory after deleting the / .CommandBox/ folder from the root, the password from the password.txt file was successfully configured in the Lucee admin.
Details
Details
Assignee
Pothys - MitrahSoftReporter
Gavin BaumanisPriority
CriticalLabels
New Issue warning screen
Before you create a new Issue, please post to the mailing list first https://dev.lucee.org
Once the issue has been verified, one of the Lucee team will ask you to file an issue
I posted this in the ORTUS forums believing it was a CommandBox issue.
, told me it was a Lucee bug - and the “fix” was to clear my browser cookies.
(Which did indeed work)
So here - is my bug report / the steps I did to produce the error - and the stack trace from the error, too.
I am on Windows.
I am in the webroot.
I have the latest commandbox installed
I have the latest cfconfig installed
I am using lucee-light 5.4.6.9
I run
boxI run
server forget --all --forceI run
server startI run
cfconfig set adminpassword=myPassword toFormat=luceeServer(I get
[adminpassword] set)If I try and log in to the server admin at
localhost/lucee/admin/server.cfm, I get:No access, password is invalid(that is to say that I don’t get the form - asking me for a password. The “proper”
server.cfmdoes not successfully get processed - I get a yellow lucee exception error screen)It doesn’t matter if I restart the server before trying to access the server admin - or not.
I get the same error message, regardless of combination of commands.
I also tried setting the web admin password with:
cfconfig set adminpassword=myPassword toFormat=luceeWeb(I get
[adminpassword] set)If I try and login to the WEB admin I get:
I also tried adding a
password.txtfile into thecontextdirectory oflucee-serverBut that didn’t work either.
In that the file was never used by the server after a restart (or stop - then start).
The password.txt file is still in the context directory.
(and yes I am certain I am the right place as I used:
server info property=serverHomeDirectory) to get the start of the path.I also tried setting the password via an environment variable.
When I do this - I see during startup - commandbox stating that it found the setting and applied it.
However - I still cannot login, and I get the same error message.
Additionally;
If I forget the server,
start the server without attempting any kind of admin setting:
I get the yellow Lucee exception error template. I don’t get the usual message about setting a password and the button to “import” the password.txt file either.
And when attempting to login to the server or web admin - I get the yellow exception screen then, too.
I am not sure how much it is going to help - but here is the stack trace I get when I try to access the server admin…
Finally,
It makes no difference if I use lucee-light or the FAT version.
As always - thanks very much!