Hello,

I am trying to recover access to an AUR account and the password reset form
gives me no way to tell what is wrong, so I am following the pointer on
that page to ask here.

The username is Wehrwolfmann and the e-mail address is
[email protected]. Entering either of them into the password reset
form returns "Invalid e-mail." I am fairly sure I have used this account
before, which is why I am asking rather than just registering again.

The reason I cannot narrow it down myself is that the handler returns the
same message for every case -- in aurweb/routers/accounts.py the lookup is

criteria = or_(models.User.Username == user, models.User.Email == user)
db_user = db.query(models.User, and_(criteria, models.User.Suspended ==
0)).first()
if db_user is None:
context["errors"] = ["Invalid e-mail."]

Because the query filters on Suspended == 0, a suspended account, an
account under a different address, and an account that never existed all
produce exactly the same response. From the outside they are
indistinguishable.

I am raising it here partly because of the "Active AUR malicious packages
incident" notice of 2026-06-12, which lists account creation and package
operations as things that may not work while the cleanup is underway. If
accounts were suspended in bulk as part of that, an ordinary user in my
position has no way to find out that this is what happened -- the site
simply tells them they do not exist.

So, two questions:

1. Could someone with database access tell me whether an account exists
under that name or that address, and if so, whether it is suspended?

2. If it was caught up in the incident cleanup, what is the right way to
ask for a review?

I would rather not register a second account while this is unresolved,
since that would look like working around a suspension. If it turns out no
such account ever existed, I will register normally once account creation
is working again.

As a separate and much smaller point: it might be worth distinguishing the
suspended case in that handler, or at least wording the message so it does
not assert that the address is invalid. It is a small change in the same
function, and it would save the next person in this situation from
guessing. I am happy to open an issue for that if it is wanted.

Thanks,
Wehrwolfmann

Reply via email to