20 Apr 2018, 6:37 PM
Administrator
- Join Date:
- Sep 2009
- Location:
- Stuart, FL
- Posts:
- 14,119
- Plugin Contributions:
- 56
Admin change customer password, special chars
As identified in this (https://www.zen-cart.com/showthread.php?179888-Encrypted-Master-Password-support&p=1344869#post1344869) EMP posting, since the password fields in the admin are sanitized, changing a customer's password to a value that includes an HTML special character, e.g. &<>"', will result in the customer not being able to log in with that password.
Create a test customer on the storefront. Log into the admin, navigate to Customers->Customers to select that customer. Click the associated 'reset pwd' button and change the customer's password to test&value.
Now, go to the storefront (with that customer logged out) and attempt to login with the test&value password ... it's rejected!