I was trying to debug a client which had issues with the one-time-login-url token and I have realized that this token is not shown in the email logs.

Would it be possible to capture the log after the replacement ? Currently when looking at the "account created by an administrator" email log, the token [easy_email:recipient_uid:0:entity:one-time-login-url] is not shown as if it didn't work.

Comments

yonailo created an issue. See original summary.

zengenuity’s picture

zengenuity commented
Status: Active » Closed (works as designed)

Security-related token evaluations are not saved in the log. If someone had access to create emails but not administer users, they could use the password reset functionality and email log to take control of other users' accounts. So, we purposely don't allow this.

Tokens that aren't security-related are replaced before being stored in the log. The list of "unsafe" tokens is in the code here: https://git.drupalcode.org/project/easy_email/-/blob/3.0.6/src/Service/E...

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.