adam/Piwigo
1
0 Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-11-03 07:22:22 +01:00
Code Issues 657 Packages Projects Releases Wiki Activity

Improve "Send my connection settings by email" text #785

New Issue
Open
opened 2026-10-05 00:17:16 +02:00 by adam · 2 comments
adam commented 2026-10-05 00:17:16 +02:00
Owner
Copy link
Copy source

One of our users was surprised to get their password e-mailed to them upon registration, since they had left the default "Send my connection settings by email" checked. They had interpreted it to mean "use this email address to send password reset links."

It would be useful if this were changed (at least in the en_US language) to something like "Email me a copy of my username and password"

One of our users was surprised to get their password e-mailed to them upon registration, since they had left the default "Send my connection settings by email" checked. They had interpreted it to mean "use this email address to send password reset links." It would be useful if this were changed (at least in the en_US language) to something like "Email me a copy of my username and password" <!-- github-sync-id:324740578 -->
adam commented 2026-10-05 00:17:18 +02:00
Author
Owner
Copy link
Copy source

I know this is pretty old, but since I just installed today and it's still doing that, I figure I'll pipe in anyway: Ideally, passwords shouldn't be sent over email at all. It's just not secure enough a protocol for that. Ideally, the admin who created the account shouldn't know the password, either.

Since the system already has a "forgotten password" function that lets the user reset their password with a token, user accounts created by an admin could send one of those, instead, so that the account doesn't have a password until the user connects the first time and sets it themselves.

I know this is pretty old, but since I just installed today and it's still doing that, I figure I'll pipe in anyway: Ideally, passwords shouldn't be sent over email at all. It's just not secure enough a protocol for that. Ideally, the admin who created the account shouldn't know the password, either. Since the system already has a "forgotten password" function that lets the user reset their password with a token, user accounts created by an admin could send one of those, instead, so that the account doesn't have a password until the user connects the first time and sets it themselves. <!-- github-comment-id:1138075877 -->
adam commented 2026-10-05 00:17:18 +02:00
Author
Owner
Copy link
Copy source

Hi Targen, in term of security, as a user and a system admin, I agree with your remark.

Hi Targen, in term of security, as a user and a system admin, I agree with your remark. <!-- github-comment-id:1138332149 -->
Sign in to join this conversation.
No Branch/Tag Specified
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
adam (Adam Wojcieszonek)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: adam/Piwigo#785