Describe the bug
Clicking the "reset password" button in a user profile in the Apex administrative back end sends a password reset link to the member, this is our preferred behavior. A password reset in the Global chapter sends an actual password. We would like all of our chapters set to have the same behavior (the password link), but it does not seem to be configurable by us.
What kind of user are you?
Admin
To Reproduce
Steps to reproduce the behavior:
Open a user profile in Global chapter
Click on 'Reset password'
Check email for the user
Email will contain a password in plain text. This is bad - it tells the world that you aren't one-way hashing your passwords, meaning you are not using industry best practices. It ALSO locks the user out of their account, in the case where the administrator has been socially engineered or has made a mistake and reset the wrong user.
Expected behavior
Email should NOT contain a plaintext password. Instead, the user should receive a password reset link.
Describe the bug Clicking the "reset password" button in a user profile in the Apex administrative back end sends a password reset link to the member, this is our preferred behavior. A password reset in the Global chapter sends an actual password. We would like all of our chapters set to have the same behavior (the password link), but it does not seem to be configurable by us.
What kind of user are you? Admin
To Reproduce Steps to reproduce the behavior:
Expected behavior Email should NOT contain a plaintext password. Instead, the user should receive a password reset link.
Screenshots