wid-tech / website

1 stars 0 forks source link

Password Reset behavior different between Apex and chapters #58

Closed pamelatech closed 3 years ago

pamelatech commented 3 years ago

Describe the bug Clicking the "reset password" button in a user profile in the Apex administrative back end sends a password reset link to the member, this is our preferred behavior. A password reset in the Global chapter sends an actual password. We would like all of our chapters set to have the same behavior (the password link), but it does not seem to be configurable by us.

What kind of user are you? Admin

To Reproduce Steps to reproduce the behavior:

  1. Open a user profile in Global chapter
  2. Click on 'Reset password'
  3. Check email for the user
  4. Email will contain a password in plain text. This is bad - it tells the world that you aren't one-way hashing your passwords, meaning you are not using industry best practices. It ALSO locks the user out of their account, in the case where the administrator has been socially engineered or has made a mistake and reset the wrong user.

Expected behavior Email should NOT contain a plaintext password. Instead, the user should receive a password reset link.

Screenshots image

mcresilkstart commented 3 years ago

@pamelatech I have changed this to the password reset link for all chapters. Please check and close issue if now ok.

hlflanagan commented 3 years ago

Looks good to me.