291669 - Changing password should not send an email containing the new password

Status: RESOLVED FIXED

(addons.mozilla.org Graveyard :: Developer Pages, defect, P5)

Description

[Jason Chu]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050422 Firefox/1.0+
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b2) Gecko/20050422 Firefox/1.0+

After a user changes his password, an email titled "Your New Mozilla Update
Password" is sent containing the new password in plaintext.  This is quite
undesireable.  A better alternative would just be a "Your Mozilla Update
password has been changed" email that says, "Your password has been changed.  If
you did not change your password, <insert things to do>.  Thanks and have a
peachy day."

Reproducible: Always

Steps to Reproduce:

Comment 1

[alanjstr]

Attachment: Change to different include

Comment 2

[alanjstr]

Attachment: new include

Comment 3

[Michael Morgan [:morgamic]]

I think this could be accomplished without adding a new file and duplicating code.  
Could you try to do this by flagging re-using the same file with an option to
display or not display the pw based on whether or not it is a 'forgotten
password' email?

Comment 4

[Michael Morgan [:morgamic]]

Comment on attachment 181680 [details] [diff] [review]
Change to different include

Adding another include is not necessary.

Comment 5

[Michael Morgan [:morgamic]]

Comment on attachment 181681 [details] [diff] [review]
new include

Adding another include is not necessary.

Comment 6

[Michael Morgan [:morgamic]]

Mass change - bugs to be read / (re)confirmed.

Comment 7

[Cameron]

AMO bugspam. Correcting QA contacts on OLD bugs ([e-mail])

-> Correct QA contact ([e-mail])

Filtermeplzkthx

Comment 8

[Justin Scott [:fligtar]]

Fred, what's this like in Remora?

Comment 9

[Fred Wenzel [:wenzel]]

No passwords are sent out via email in Remora. Even the password change request just sends out a URL with a possibility to change the PW. It won't send another email once you changed it.

Marking this fixed.