0

I have a state-level site with members who are imported from a CSV file. Their passwords cannot be changed or edited on the front-end as said passwords are assigned by the national-level and passed down to the state-level.

Basically, I need a forgot password email that just sends their existing password (stored as a custom member field) to their email address. I've scoured devot-ee and this site, but cannot find a solution. I'm using Solspace User module to generate my password reset email, which ideally looks like this:

Hi {name},

Your login information for the {site_name} website is:

Email: {email}
Password: {password}

Thank You

{site_name}
{site_url}

Anyone got any ideas?

Improve this question
2
  • Just for clarification, are you having an issue retrieving the password field from Solspace's User module or with sending the triggered email?
    – rchrdg
    Nov 1, 2014 at 23:51
  • I'm having trouble retrieving the password field. The email is sending as intended.
    – soire
    Nov 2, 2014 at 21:39

1 Answer 1

Reset to default
2

Passwords in EE and also used by the Solspace User module (and Freemember - the free alternative to User) are all one-way encrypted. So when a user logs in, in encrypts their password and matches it to the encrypted version held in the database. This means the password is never and can never be decrypted - this provides the best security.

So the email template you're referring to in the User module isn't a password reminder, but a password reset (even though the documentation refers to it as reminder) - the documentation can be found here.

But as you mention, you're using a custom member field to store the unencrypted raw password - this is a very bad idea and has high security issues. Is this manually set?

The problem is one of two things...

  1. I'd expect it's because you're using the field name "password" for the password, which will conflict with the real member field for password and problem Solspace User won't like it much. Try renaming to "raw_password"

  2. Possibly the email reminder/reset email doesn't allow for you to output custom member fields? Try testing it with other member fields (create one as a test).

Improve this answer
4
  • +1 for this. Clear text passwords are a really, really bad day just waiting to happen.
    – foamcow
    Nov 2, 2014 at 19:02
  • Thank you for your replies! I understand this is not an ideal situation, but I'm not necessarily fishing for an opinion on that topic as it is the only way that I saw to handle the situation that I outlined in my first paragraph. Password reset is not an option for me, I literally need to have the password sent in an email-secure or not.
    – soire
    Nov 2, 2014 at 21:41
  • The email sends without issue, but it does not allow global variables such as {location} but does allow {username} ...? Anything I put between these tags, including the tags themselves, are printed in plain text, such as {exp:member:custom_profile_data}
    – soire
    Nov 2, 2014 at 22:03
  • It won't parse it using the EE parser - it's a custom module that will only be parsing member variables within it's own code - so typically it might get the user fields from the DB and convert them to variables to parse in the email template - no additional tags, no globals. So going back to what I suggested, have you tried renaming your custom "password" field to raw_password (held in the member fields and with a value) and outputting that in the email template?
    – Peter Lewis
    Nov 4, 2014 at 17:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.