Getting user password in plain text

[kh99]

Originally Posted by Scanu

Make sure the password is not encrypted using javascript when sending the form. If so there isn't a php variable which contains plain text password. You would habe to edit template and remove something like onsubmit="md5(...password)...."

That's true, but there are ways to turn it off without editing the javascript. You can define the constant DISABLE_PASSWORD_CLEARING (maybe in config.php) to turn off the feature entirely. If you only want to turn it off for password changes, you can set the variable $show['nopasswordempty'] to 1, maybe at the hook parse_templates, like:

if (THIS_SCRIPT == 'profile')
   $show['nopasswordempty'] = 1;