3

I am running WordPress with WooCommerce and Theme My Login plugins. When a user registers on my site it sends them a confirmation email and then they can click to activate account. Problem is when the user goes to login they get an error of incorrect password. If the user uses the forgot password link and resets the password then they can login without any errors. What might cause this problem? Is the password being encrypted with the wrong method?

I went through the registration process and checked the string in the php users table.

Password in php table after registration:

$P$BF/gIt6dFfBBuNx6rP41Qv3i71TUie1

Password in php table after change password to same password:

$P$BxpByDbNU3vr3sytTOcbzttp1tOodH1

Do Theme My Login and either WooCommerce or WordPress use different encryption methods?

5
  • These passwords are one-way hashed, rather than encrypted. But also, the system probably generates a different hash every time a password is stored (same password by different users, different hash in db), so the two different hashes you are seeing (after registration and after change password) is quite normal in a working system.
    – MrWhite
    May 28, 2014 at 14:09
  • What would cause the first hash to create a password that doesnt work for logging in?
    – tech
    May 28, 2014 at 15:10
  • My best guess is that registration is using password_hash or crypt and then the login is using MD5. I guess another situation would be if one of them is using a static salt. Either way I am not sure how to figure out what it is actually doing.
    – tech
    May 28, 2014 at 15:17
  • Both these hashes look consistent with output from the crypt() function, in fact they both look as if they are using the same algorithm? (There shouldn't be any MD5 hashing going on here.) I don't know why there would be a difference between "registration" and "password change", other than maybe there is a difference in encodings somewhere? (The same method should be used for both?) If you are willing to give up the password, I might be able to check whether these hashes are valid?!
    – MrWhite
    May 28, 2014 at 18:03
  • Theme My Login and WooCommerce shouldn't do anything different when signing up a new user. They are simply passing the data to the appropriate WordPress functions. Is this happening to all users or only certain ones? Are you using TML's custom email functions?
    – JCL1178
    May 29, 2014 at 4:43

2 Answers 2

0

I found a solution that worked for me:

In the file theme-my-login/includes/class-theme-my-login.php the function register_new_user($user_login, $user_email) always assigns a random password. Then, 1. to search the following lines: $user_login = $_POST['user_login']; $user_email = $_POST['user_email']; and add the following line to get the password which the user put: $user_pass = $_POST['pass1']; $this->errors = self::register_new_user( $user_login, $user_email, $user_pass );

  1. in the last function you add the parameter $user_pass: public static function register_new_user( $user_login, $user_email, $user_pass ) {

  2. and finally, you comment: //$user_pass = apply_filters( 'tml_user_registration_pass', wp_generate_password( 12, false ) );

This applies only if the user enters his password in the registry.

0

Have you updated the plugin? At one point this was a bug in TML that got resolved.

Theme My Login handles user registration in class-theme-my-login.php > register_new_user on line 975, which contains logic for generating the registered user's password.

Woocommerce handles user ("customer") registration in wc-user-functions.php > wc_create_new_customer on line 44, which contains logic for generating the registered user's password.

I'm not entirely sure if both plugins are trying to handle user registration at the same time (it could depend on the settings you have enabled), but there could very well be a conflict here. A good test might be to disable Theme My Login and see if the problem goes away.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.