0

I'm seeing some very strange behavior from the customer password reset form... The instance in question is running Magento 1.9.3.9

From the backend, I can reset a customer's password without issue. However, when the user tries to change their password from either the

Customer Dashboard (design > frontend > default > {companyName} > template > customer > form > edit.phtml) or the password reset email (app > design > frontend > base > default > template > customer > form > resetforgottenpassword.phtml)

There is no error generated and the user is able to log into the site using their new password.

But there is no password change confirmation generated and, if the user logs out of their account, they are able to log back in using their previous (pre password reset) password. And, once they do use the old password, they are no longer able to use the new password!

On top of that, many of the posts that say the customer's password (hashed) is stored in the customer_entity_varchar table and others that say it is stored in the customer_entity table. Either way, they usually say that it is located in the password_hash column. Oh, did I mention that in our Database, neither the customer_entity_varchar or the customer_entity table contains this column? I have NO idea where the password hash is being stored.

What the heck? Am I going crazy?

  • I finally found where the customer password hashes were being stored! They are in the customer_entity_var table, but they are not in the password_hash column! They just have a different attribute ID. – Thor Aug 1 '19 at 16:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.