Why the Magento 1.9.3.4 welcome email still send customer password in text plain?

Question

Why Magento 1.9.3.4 welcome email still send customer password in plain text ?

I think this is not safe at all. I know that I can replace the line <strong>Password</strong>: {{htmlescape var=$customer.password}} to not show the passwords

I thought, after 1.9, it won't show passwords any more, but accidentally I found the welcome email include the password in plain text .

I wonder whether my magento codes have Security problem, because I think the password should not been seen and shown in any methods.

Answer 1

Yes, it is true that the Welcome mail contains the password in plain text, but there are some who say that it is a bad practice and other not ! I let you read this answer with the advantages and disadvantages and the Magento Security Enhancements

In any case you can change it by making one of these two choices:

In app/locale/YOURLANGUAGE/template/email/account_new.html you find:

<strong>Password</strong>: {{htmlescape var=$customer.password}}

Choice 1: You can change this by changing this email template and either remove this line or replace it with something like:

The password you have chosen when creating this account.

Choice 2: You could also create a new email template in the Admin Panel via System > Email Templates and then set this new template in System > Configuration > Customers > Customer Configuration > Create New Account Options > Welcome Email