Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[Bug]: Superusers can't request a password reset link

Open
  • Is something wrong?
#7,283 5 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 2 days

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
55/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
csharp, sql
Domain
authentication, backend

Research direction

Start with SendPassword.ascx.cs around line 325 and trace the GetUsersByEmail lookup through DataProvider.cs around line 2145 to the stored procedure and vw_Users. Check how that lookup handles superusers when email is used as the username, without changing unrelated lookup behavior. Done means a superuser can request a password-reset email in the described settings, with existing lookup behavior preserved.

Written by the indexing model from the issue text.

Description

Status: New
Is there an existing issue for this?
  • I have searched the existing issues
What happened?

Superusers can't request a password reset link from the forgot password page when "use email as username" is enabled.

Steps to reproduce?
  1. Have a superuser account
  2. Enable "Use Email Address as Username" in registration settings
  3. Go to a login module, click "Reset Password"
  4. Enter the superuser account email
  5. Submit
Current Behavior

No password reset email is sent.

Expected Behavior

Password reset email is sent.

Relevant log output
Admin log: "Password Sent Failure" "Cause:If the details entered for <email> were correct, you should receive an email message shortly with a link to reset your password."
Anything else?

This appears to happen because of the way users are looked up.

  1. https://github.com/dnnsoftware/Dnn.Platform/blob/4b0214b8dad46cc3173967d9800f208f0db60466/DNN%20Platform/Website/admin/Security/SendPassword.ascx.cs#L325 Calls the UserController. "ShowEmailField" comes from the "Use Email Address as Username" setting (among other things, who's cases are probably also broken). When true, it calls UserController.GetUsersByEmail with the current portal ID.
  2. https://github.com/dnnsoftware/Dnn.Platform/blob/236dbe3bcdf02e7c09e73b710544b7aa322b1a10/DNN%20Platform/Library/Data/DataProvider.cs#L2145 UserController calls into the membership provider, which eventually ends up here. The "GetUsersByEmail" stored procedure selects from "vw_Users". "vw_Users" replaces UserId with 0 when JOINing [Users] with [UserPortals], which causes it to never return a user if it is a super user.
  3. Since the user cannot be looked up, password reset treats it as if an invalid email/username was entered, and just does nothing.

The solution probably needs to change how users are looked up. I imagine "vw_Users" prevents looking up super users for security reasons, so probably don't want to change that. Instead using a method that doesn't utilize that view is probably what needs to happen.

Affected Versions

10.3.2 (latest release)

What browsers are you seeing the problem on?

No response

Code of Conduct
  • I agree to follow this project's Code of Conduct
Dominant language
C#
Stars
1.1k
Forks
791
Avg merge
2d 49m
Merged PRs (30d)
20

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from dnnsoftware/Dnn.Platform

All issues in dnnsoftware/Dnn.Platform

Similar issues

More C# issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.