Passwords are still saved in a non-secure way about simple-membership HOT 7 CLOSED

Hi Uwe.

We had discussions with the team and decided to make following changes:

1. Add note for email activation feature description that it stores temporary decryptable passwords.

2. Add "swpm_email_activation_data" filter so you can modify temporary email activation data per your needs. Remove password from it, for example.

I have also made a tiny plugin that does the thing for you - it removes plain text password before it's stored in database. Using this plugin you can still use latest versions of Simple Membership plugin without the need to modify its core files. https://github.com/erommel/simple-membership-enchancements

from simple-membership.

Hi Uwe and thank you for your input.

Decryptable password is saved to the database temporary, until user activates his\her account if Email Activation is enabled. After account is activated, the data gets deleted. It also gets deleted by cron job which runs daily, to remove potential leftovers in situations where user never actually activated his\her account. After the activation (or if it's not enabled), only password's hash is stored in DB.

And yes, plain password is needed for autologin and\or sending password to user email after registration. I agree it's not a good idea to do that (send email with password), but that's it worked over years and customers definitely used to this.

I have an idea how this could be changed though. We can add an option to the settings, something like "Allow less-secure passwords handling" (which should be DISABLED by default), which allows site admin to decide whether he\she wants to trade some security for the functionality he\she used to.

I will also research if it's possible to handle autologin stuff without storing plain text password.

Keep in mind this should be discussed with the team first, as at the moment it's just my suggestion.

from simple-membership.

Thanks for your reply. I fully understand your thoughts conc. backward compatability (not taking a feature away from your users). And I very much appreciate your ideas for how to address the issues (additional info, option).

I look forward to the further developments!

from simple-membership.

Wow! Thank you for the changes and the enhancements plugin!

from simple-membership.

Just noticed: Plain password is back! How could this be?! Took me quite some time to understand: I now use the Form Builder Addon, which has a similar update_options code which is not covered by the additional filter.

from simple-membership.

Just installed Form Builder Addon 4.7.6 and now the hook works again! Thank you very much!

from simple-membership.

Sorry for late reply.

Yep, it was implemented along with the changes in core plugin.

from simple-membership.