if filter show_password_field is set to false, you cannot add new users

[pampfelimetten]

Steps to reproduce:

1. add_filter('show_password_fields', false);

2. Try to add a new user, after entering the data you get the error message "ERROR: Please enter your password.".

[coffee2code]

This is true. As the OP states, disabling display of password fields via

add_filter( 'show_password_fields', '__return_false' );

causes the password fields not to be shown on the user creation admin form (http://example.com/wp-admin/user-new.php).

My understanding of the filter's purpose is to make it possible to prevent users from using the profile form to change their password. This situation is indeed covered by the application of this filter in wp-admin/user-edit.php. The application of this filter in wp-admin/user-new.php does not seem appropriate (no sense in creating a user if you can't supply their password).

Attached is a patch, 15115.diff, which removes the filter from the user creation form.

Relatedly (though separate ticket at best): should those with create_users capability not have this filter applied to them at all? That way admins would always be able to edit user passwords. (Of course, this could be implemented via a plugin or the code adding the filter in the first place.)

[coffee2code]

Aforementioned patch.

[pampfelimetten]

Well, I've discovered the bug because I wanted to use the filter, and there are scenarios where it can be useful. Removing it wasn't my intent at all, I'd rather like to see it improved.

What I want to do: We have a pretty big cms-like installation with 1000s of users. There is an intermediate management level called stationmanagers between the admins and authors. They can add new users to their station. But to keep it as simple as possible, we want to autogenerate the password which is sent to the new user, so we want to disable the password input field for the stationmanagers.

Maybe it would be a good idea to use different filters for users-new.php and user-edit.php? And of course fix the issue that using the filter prevents the user-new to function at all, as I've described in the ticket description.

[mdawaffe]

+1 on 15115.diff

Agreed it's confusing. Workaround for now would be to roll a better plugin than __return_false().

[chriscct7]

I agree, the filter applying on new user makes no sense. Adding for core review

[wonderboymusic]

In 34582:

Profile: on user-new.php, don't allow the password fields to be hidden. When hidden, you can't add a user.

Props coffee2code.
Fixes #15115.

[DrewAPicture]

There was a duplicate of this hook in user-edit.php. We need to move the hook doc since the original was removed in [34582].

[DrewAPicture]

In 34590:

Docs: Relocate the hook doc for the show_password_fields filter to its duplicate, since the original was removed in [34582].

Adds a changelog entry noting the adjustment in behavior, and simplifies the conditional logic.

Fixes #15115.