Yes, its supposed to send the password with any failed cp logins attempted. If the username is mistyped it will still send the password but again this is only for cp logins. Only staff members should be trying to login from here anyway. It doesn't send anything for regular logins. If you'd rather have it send an encrypted password instead simply skip the edits to adminfunctions.php and use the vb_login_md5password variable instead of the one added with the hack.
|