WordPress.org
Get WordPress

Make WordPress Core

Opened 11 years ago

Last modified 11 days ago

#33186 reopened task (blessed)

Stop sending password via e-mail when creating a new site in Multisite

Reported by: markjaquith Owned by:
Priority: normal Milestone:
Component: Networks and Sites Version:
Severity: normal Keywords:
Cc: Focuses: multisite

Description

We should continue on this "don't e-mail passwords work" and stop e-mailing passwords when new sites are created.

see #33175 and #32428

Change History (6)

#1 @SergeyBiryukov
11 years ago

  • Component General → Networks and Sites
  • Focuses multisite added

This ticket was mentioned in ​Slack in #core-multisite by jeremyfelt. ​View the logs.
11 years ago

#4 @Mista-Flo
10 years ago

  • Resolution → duplicate
  • Status new → closed

Duplicate of #33209.

#5 @Mista-Flo
10 years ago

  • Resolution duplicate
  • Status closed → reopened

#6 @realloc
11 days ago

Still reproducible on trunk. Adding a site with an email address that does not belong to an existing user sends the username and the password in plaintext. No link to set a password is sent.

site-new.php generates a password and calls wpmu_create_user(), which sends nothing, then wpmu_welcome_notification(), which substitutes it into the PASSWORD token of welcome_email. wp_new_user_notification() is never reached, so the single site reset link logic never applies here.

That matters for #41169. The help text was corrected in [41064] to promise "a link to set the password", on the grounds that since [33023] a link is sent. But [33023] came from #32589 and changed pluggable.php, not this path. The string was aligned to a behaviour that never existed here.

So whether site creation should email a password was answered in 4.9. What is left is how to deliver it without breaking customised welcome_email templates: change what PASSWORD resolves to, send a reset key instead, add a RESETLINK token, or some combination.

Note: See TracTickets for help on using tickets.