Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I am running WordPress with WooCommerce and Theme My Login plugins. When a user registers on my site it sends them a confirmation email and then they can click to activate account. Problem is when the user goes to login they get an error of incorrect password. If the user uses the forgot password link and resets the password then they can login without any errors. What might cause this problem? Is the password being encrypted with the wrong method?

I went through the registration process and checked the string in the php users table.

Password in php table after registration:

$P$BF/gIt6dFfBBuNx6rP41Qv3i71TUie1

Password in php table after change password to same password:

$P$BxpByDbNU3vr3sytTOcbzttp1tOodH1

Do Theme My Login and either WooCommerce or WordPress use different encryption methods?

share|improve this question
    
These passwords are one-way hashed, rather than encrypted. But also, the system probably generates a different hash every time a password is stored (same password by different users, different hash in db), so the two different hashes you are seeing (after registration and after change password) is quite normal in a working system. –  w3d May 28 at 14:09
    
What would cause the first hash to create a password that doesnt work for logging in? –  tech May 28 at 15:10
    
My best guess is that registration is using password_hash or crypt and then the login is using MD5. I guess another situation would be if one of them is using a static salt. Either way I am not sure how to figure out what it is actually doing. –  tech May 28 at 15:17
    
Both these hashes look consistent with output from the crypt() function, in fact they both look as if they are using the same algorithm? (There shouldn't be any MD5 hashing going on here.) I don't know why there would be a difference between "registration" and "password change", other than maybe there is a difference in encodings somewhere? (The same method should be used for both?) If you are willing to give up the password, I might be able to check whether these hashes are valid?! –  w3d May 28 at 18:03
    
Theme My Login and WooCommerce shouldn't do anything different when signing up a new user. They are simply passing the data to the appropriate WordPress functions. Is this happening to all users or only certain ones? Are you using TML's custom email functions? –  JCL1178 May 29 at 4:43

1 Answer 1

Actually theme my login and WooCommerce both have options for allowing users to register. TML allows for custom passwords as an extra setting. If you enable this and also have the setting in WooCommerce enabled which allows registration on the My Account page you'll see duplicate password inputs. One set from WooCommerce, another from TML.

Both plugins hook into WordPress registration, so it's likely TML fires when someone registers through WooCommerce sets a default random password which is what WordPress does as usual. It may be firing after WooCommerce' hook. Check the action hooks in each plugin.

You're far better off customizing your login page without a plugin, and simply use WooCommerce templates. If you'd like help customizing your WC login page to match your site just contact me.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.