Am I mislead here, or isn't the password still automatically generated when the field is left empty in the backend (it was the case in earlier Joomla versions, and i'm 99% sure it still is in latest Joomla) ?

This has the double brilliant advantages that:

1. the password is really random
2. you as the creator don't see the password of the user that gets directly mailed to the user, so can't login for him.

Thus I believe that this change is not an improvement, security-wise.

Best Regards

Beat is right. If no password is entered, Joomla will generate a random one. I just verfified it (didn't even know that).

I'm closing this since it would remove a very nice (hidden) feature.

Is #3770 still valid though?

Matt Thomas
203.632.9322
http://betweenbrain.com/

Sent from mobile. Please pardon any typos or brevity.
On Jun 13, 2014 8:03 AM, "Thomas Hunziker" notifications@github.com wrote:

Closed #3769 #3769.

—
Reply to this email directly or view it on GitHub
#3769 (comment).

Is #3770 still valid though?

It behaves the same as 3.3, creating a random password when left empty. Just tested as well

Thanks

Matt Thomas
203.632.9322
http://betweenbrain.com/

Sent from mobile. Please pardon any typos or brevity.
On Jun 13, 2014 8:14 AM, "Thomas Hunziker" notifications@github.com wrote:

Is #3770 #3770 still valid
though?

It behaves the same as 3.3, creating a random password when left empty.
Just tested as well [image: ]

—
Reply to this email directly or view it on GitHub
#3769 (comment).

The issue is that if a random password is generated but one has also set the User Joomla plugin to NOT send the account credentials to the new user, then the password is unknown

Closing, this is taken into account in the model...

@infograf768 wrote:

The issue is that if a random password is generated but one has also set the User Joomla plugin to NOT send the account credentials to the new user, then the password is unknown

Agreed that doesn't make sense, but then password reset feature can still be used by the new member (could be part of a mail sent to him separately). It would make sense to fix that behavior bug due to that new feature of the plugin, e.g. require password only in that case, or still send the credentials if password left blank.

And maybe to clarify the information text for the password field (e.g. "leave blank for random password emailed to the new user"), so it's not a "hidden nice feature anymore"

Nevermind, as taken in account in model already, all ok. Can be left closed.