!password is not populated in slave user registration email [#1147128]

The cookie exchange doesn't bring the password all the way back, starting from _bakery_register_submit().

Name and mail are stashed in $_SESSION for the slave to potentially refer to later. The easiest solution would involve this, but we might not want plain text passwords laying around $_SESSION. Otherwise, it would have to be carried through the two key exchanges.

Or, we could not send the password in email and rely on the login URL. I like this since passwords in email are not great. We could change the email content on enable/update if it is the default, or alert the user if it contains !password.

Comments

Comment #1

greggles

he/him

English

Denver, Colorado, USA

commented 4 May 2011 at 18:43

Or, we could not send the password in email and rely on the login URL. I like this since passwords in email are not great. We could change the email content on enable/update if it is the default, or alert the user if it contains !password.

Yes, please. I think that's a reasonable requirement that if someone wants to use bakery they can't have passwords in their welcome emails.

Comment #2

coltrane

he/him

commented 4 May 2011 at 18:43

Yeah, I meant to document this as a known issue. I think the best answer is to remove the token from the email.

Comment #3

drumm

he/him

NY, US

commented 4 May 2011 at 19:19

Here is a draft of the new text:

!username,

Thank you for registering at !site. You may log in by clicking on this link or copying and pasting it in your browser:

!login_url

This is a one-time login, so it can be used only once.

After logging in, you will be redirected to !edit_uri so you can change your password.

-- !site team