mahara-contributors team mailing list archive

[Hugh Davenport <1045123@xxxxxxxxxxxxxxxxxx>]

*** This bug is a security vulnerability ***

Public security bug reported:

When an admin creates a user with a set password. It should be assumed that this password is delivered to the user out of band, and shouldn't be sent in clear text.
If the password field is left blank, we should treat that the same as if we just finished a registration, the user gets a one time URL to click on which forces them to set a password.

** Affects: mahara
     Importance: Medium
         Status: Triaged

-- 
You received this bug notification because you are a member of Mahara
Contributors, which is subscribed to Mahara.
https://bugs.launchpad.net/bugs/1045123

Title:
  don't send out password for admin created users

Status in Mahara ePortfolio:
  Triaged

Bug description:
  When an admin creates a user with a set password. It should be assumed that this password is delivered to the user out of band, and shouldn't be sent in clear text.
  If the password field is left blank, we should treat that the same as if we just finished a registration, the user gets a one time URL to click on which forces them to set a password.

To manage notifications about this bug go to:
https://bugs.launchpad.net/mahara/+bug/1045123/+subscriptions