Send set password link instead of the actual password to new users. #31257

peterfabian · 2021-11-19T15:39:51Z

All Submissions:

Have you followed the WooCommerce Contributing guideline?
Does your code follow the WordPress' coding standards?
Have you checked to ensure there aren't other open Pull Requests for the same update/change?

Changes proposed in this Pull Request:

Closes #31035.

How to test the changes in this Pull Request:

Set up a new WC store, use this PR.
Go to Woo > Settings > Accounts & Privacy and enable Allow customers to create an account during checkout
and Allow customers to create an account on the "My account" page while letting WC generate username and password.
Add a product and enable one payment gw.
Go through the checkout and enable the checkbox to create a new user account.
Verify the email receives a link to set a new password instead of the password itself.
Check that you can set the password and log in with it.
Try to register/create the user account from My Account page.
Repeat steps 5 & 6
Go to Woo > Settings > Accounts & Privacy and disable creating of the new password automatically.
Create a new user account through checkout.
Check that the email doesn't contain the link to set a new password.
Create a new user account through My Account page.
Check that the email doesn't contain the link to set a new password.

Other information:

Have you added an explanation of what your changes do and why you'd like us to include them?
Have you written new tests for your changes, as applicable?
Have you successfully run tests with your changes locally?

Changelog entry

Add set password link to emails when creating new user account.

FOR PR REVIEWER ONLY:

I have reviewed that everything is sanitized/escaped appropriately for any SQL or XSS injection possibilities. I made sure Linting is not ignored or disabled.

vedanshujain

LGTM and testing well! Left a minor stability comment

vedanshujain · 2021-11-22T09:55:29Z

plugins/woocommerce/includes/emails/class-wc-email-customer-new-account.php

 					'sent_to_admin'      => false,
 					'plain_text'         => false,
 					'email'              => $this,
+					'set_password_url'   => $this->set_password_url,


is this guaranteed to be set before it's called? if not, then maybe we can create a getter method for set_password_url which will either generate the password URL if it does not exist yet, or return the generated URL if it already exist. wdyt?

That's a good point. I assumed it would be fine, because in the same place we use $this->user_login and $this->user_pass that are set in the same place (the trigger method in the same class).

Do you think that's sufficient guarantee or shall we switch those to getters as well?

This is a public method, so we don't know when it could be called. That said, I'm approving because your explanation makes sense and should have been set in trigger class.

vedanshujain · 2021-11-22T09:55:47Z

plugins/woocommerce/includes/emails/class-wc-email-customer-new-account.php

 					'sent_to_admin'      => false,
 					'plain_text'         => true,
 					'email'              => $this,
+					'set_password_url'   => $this->set_password_url,


same as above, this could be null before it's called.

vedanshujain

LGTM! Leaving the merge to you based on if you want to take action on https://github.com/woocommerce/woocommerce/pull/31257/files#r754308635

Konamiman

Looks good to me too, tested all the cases in the PR description and it works as expected.

github-actions · 2021-11-22T17:44:01Z

Hi @peterfabian, thanks for merging this pull request. Please take a look at these follow-up tasks you may need to perform:

Add the status: needs changelog label
Add the status: needs testing instructions label

ghost · 2021-12-27T07:36:42Z

Hi team, I wanted to know that is this feature available to the users now? I updated my plugin to 6.0.0 but still the password is being sent to the users via email.

peterfabian · 2022-01-04T15:03:24Z

Hi @avidews . I just tested a fresh installation with WC 6.0 and tried creating a new account via
1.checkout and
2. My Account page.

In both cases, the email I got didn't include the password. Which workflow are you using to create a user account? Does your website maybe use custom templates you need to adjust according to how it's been done for the default templates?

templates/emails/customer-new-account.php
templates/emails/plain/customer-new-account.php
templates/myaccount/form-login.php

ghost · 2022-01-04T15:22:38Z

Hi @peterfabian.

Thanks a lot for your reply. You just solved my problem, my website is using a plugin for custom email templates and the new account email template is still using {user_pass}. I think I need to contact the plugin team to update their plugin?

Thanks lot for your help.

peterfabian · 2022-01-04T21:15:20Z

Great to hear. Yes, exactly, please contact the plugin authors.

solaceten · 2022-02-02T23:03:57Z

Greetings all and @peterfabian @rodelgc @melek

I think this is an improvement over sending plain text password, so good call!

Two questions (and I am not sure if I need to open a new ticket for this)...

When I did a test account creation, I got the welcome email with the link that invited me to set a new password which was great - however, I also received a plain text "Password Changed" notification email along the lines of "This notice confirms that your password on [website] was recently changed. If you did not change your password, please contact....." etc...

Is that the correct behaviour? Because it seems unnecessary to send it to a new user that has just registered.

If we are now inviting customers to set a password - why not go back to doing that at the checkout, so that it is all done in one place (rather than another email process!)

Thanks

melek · 2022-02-03T18:59:05Z

When I did a test account creation, I got the welcome email with the link that invited me to set a new password which was great - however, I also received a plain text "Password Changed" notification email along the lines of "This notice confirms that your password on [website] was recently changed. If you did not change your password, please contact....." etc... Is that the correct behavior?

The 'Password Changed' emails are part of WordPress. They can be disabled on your site with a filter, see this forum post for more details:

https://wordpress.org/support/topic/disable-password-changed-emails-2/

I agree with you that suppressing these emails when a new customer initially sets their password is worth considering :) If you want that functionality, I recommend filing an issue so it can be discussed.

If we are now inviting customers to set a password - why not go back to doing that at the checkout, so that it is all done in one place (rather than another email process!)

Different shop owners will have different preferences on checkout and account creation flow; I for instance think that asking the customer to go through an email process encourages extra engagement. In any case, opining on how store owners should have users set passwords is outside the scope of this change. I also don't see any reason to remove an option from the Accounts & Privacy area.

ktmn · 2022-08-06T11:30:16Z

Should have maybe bumped templates/myaccount/form-login.php version cause a string changed? I was wondering why A link to set a new password will be sent to your email address. wasn't translating, I still had A password will be sent to your email address. in my theme's override but no notice that the template had been updated.

peterfabian · 2022-08-12T13:19:50Z

@ktmn Yup, that was missed, unfortunately. Fixed in #34308

Send set password link instead of the actual password to new users.

b7c8e3e

peterfabian requested review from a team and Konamiman and removed request for a team November 19, 2021 16:24

peterfabian added 2 commits November 19, 2021 19:18

The extra parameter actually seems unnecessary.

10daece

Bump template version.

1fd893a

tomjn approved these changes Nov 22, 2021

View reviewed changes

vedanshujain reviewed Nov 22, 2021

View reviewed changes

vedanshujain approved these changes Nov 22, 2021

View reviewed changes

Konamiman approved these changes Nov 22, 2021

View reviewed changes

peterfabian merged commit ab1a357 into trunk Nov 22, 2021

peterfabian deleted the fix/31035 branch November 22, 2021 17:43

peterfabian added this to the 6.0.0 milestone Nov 22, 2021

github-actions bot modified the milestones: 6.0.0, 6.1.0 Nov 22, 2021

ObliviousHarmony modified the milestones: 6.1.0, 6.0.0 Nov 30, 2021

rodelgc added testing instructions added and removed release: add testing instructions PRs that have not had testing instructions added to the wiki. [auto] labels Dec 7, 2021

ObliviousHarmony mentioned this pull request Dec 8, 2021

Prepare WooCommerce 6.0 RC.2 #31392

Merged

ObliviousHarmony added changelog added and removed release: add changelog Mark all PRs that have not had their changelog entries added. [auto] release: cherry-pick Commits from this PR also needs to be added to current release branch. labels Dec 8, 2021

melek mentioned this pull request Jan 4, 2022

'automatically generate an account password' Accounts & Privacy setting label is outdated. #31560

Closed

5 tasks

rodelgc mentioned this pull request Jan 10, 2022

Special characters in password on checkout page lead to not working account #31582

Closed

5 tasks

solaceten mentioned this pull request Feb 3, 2022

[Enhancement]: disable the plain text "password change" notification sent upon account creation #31827

Closed

Send set password link instead of the actual password to new users. #31257

Send set password link instead of the actual password to new users. #31257

Uh oh!

Conversation

peterfabian commented Nov 19, 2021

All Submissions:

Changes proposed in this Pull Request:

How to test the changes in this Pull Request:

Other information:

Changelog entry

FOR PR REVIEWER ONLY:

Uh oh!

vedanshujain left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

vedanshujain Nov 22, 2021

Choose a reason for hiding this comment

Uh oh!

peterfabian Nov 22, 2021

Choose a reason for hiding this comment

Uh oh!

peterfabian Nov 22, 2021

Choose a reason for hiding this comment

Uh oh!

vedanshujain Nov 22, 2021

Choose a reason for hiding this comment

Uh oh!

vedanshujain Nov 22, 2021

Choose a reason for hiding this comment

Uh oh!

vedanshujain left a comment

Choose a reason for hiding this comment

Uh oh!

Konamiman left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Nov 22, 2021

Uh oh!

ghost commented Dec 27, 2021

Uh oh!

peterfabian commented Jan 4, 2022

Uh oh!

ghost commented Jan 4, 2022

Uh oh!

peterfabian commented Jan 4, 2022

Uh oh!

solaceten commented Feb 2, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

melek commented Feb 3, 2022

Uh oh!

ktmn commented Aug 6, 2022

Uh oh!

peterfabian commented Aug 12, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

vedanshujain left a comment •

edited

Loading

solaceten commented Feb 2, 2022 •

edited

Loading

peterfabian commented Aug 12, 2022 •

edited

Loading