33

This SQL works just fine to update the customer password. Tested with Magento 2.1.5. Just change "YOURPASSWORD" below (keep the xxx:es) and voila! UPDATE `customer_entity` SET `password_hash` = CONCAT(SHA2('xxxxxxxxYOURPASSWORD', 256), ':xxxxxxxx:1') WHERE `entity_id` = 1;


25

Never thought of using SHA hashing in SQL directly until I saw Robban's answer. I'd like to add that you could generate the hash in SQL too, leaving only the password that should be added. You can use variables (set-statement) to set all the necessary values upfront: SET @email='emailaddress@example.com', @passwd='test@123', @salt=MD5(RAND()); UPDATE ...


23

Children of class Mage_Customer_Model_Customer should use getPasswordConfirmation() instead of getConfirmation() Upd: In class Mage_Customer_Model_Customer, method validate() was changed Before v1.9.1: $confirmation = $this->getConfirmation(); After: $confirmation = $this->getPasswordConfirmation(); https://github.com/speedupmate/Magento-CE-...


16

This is a configuration item. In Stores > Configuration > Customers > Customer Configuration > Password Options there's some options like Password Length and Number of Required Character Classes: Above I set the minimum password length to 20 and below I get the message when trying to create an account: Not sure at which version this was ...


10

Firstly my usual comment would be, do not encrypt a password! Encryption = A two-way process, scrambling and then unscrambling data at a later date. Hashing = A one-way process, create an encrypted looking string from a given input. Hashing is not encryption, once you have something hashed it cannot be unhashed. Think of it like this you can md5 hash the ...


9

Encryption is done via the Mage_Core_Model_Encryption class. Hashing runs via the method hash which uses MD5. Not sure why did didn't go with SHA but it should be sufficient. Encrypting data for later use is done using the encrypt method that use the Varien_Crypt class that by default relies on Mcrypt to do it's job. Since it uses a factory pattern you ...


8

You can use below regular expression. (/^(?=.*\d)(?=.*[a-z])(?=.*[A-Z])[0-9a-zA-Z]{8,}$/) Explanation of this expression is (/^ (?=.*\d) //should contain at least one digit (?=.*[a-z]) //should contain at least one lower case (?=.*[A-Z]) //should contain at least one upper case [a-zA-Z0-9]{8,} //should ...


7

We can use jQuery validation in Magento 2. You can add this file in '.phtml' or '.js' file. Let’s see how we can do this. 1) In input or select tag add our validation with this code: data-validate="{required:true, 'validate-custom-pass':true}" 2) Add js validation for Validate-custom-pass validation script <script type="text/javascript"> require([...


6

You do not need to modify Magento's authentication classes. You can import passwords already MD5 encrypted. I have tested this. First, a look at how Magento CE stores passwords salt = gg6s1b3f9s4dd (randomly generated every time a password is changed) password = mypassword2015 (chosen by customer) Encrypted Password = md5(salt.password).":".salt Explained ...


6

The encryption key is used for encryption and decryption, not for hashing. The user and admin passwords are just hashed. See how Mage_Admin_Model_User::_beforeSave works. $data['password'] = $this->_getEncodedPassword($this->getNewPassword()); if you dig deeper into _getEncodedPassword you will find this: protected function _getEncodedPassword($...


6

It seems you want to add a .htaccess directory protection. Ad there is no real admin folder, you need to work around this: SetEnvIfNoCase Request_URI "^/admin/" ADMIN AuthType Basic AuthName "Magento Admin" AuthUserFile /path/to/.htpasswd Require valid-user Satisfy any Order allow,deny Allow from all Deny from env=ADMIN Just add the usernames + ...


6

I don't think it's possible to set the password from inside the DB. You need SHA256 hashing for customer passwords. Here's how Magento generates it: example password in DB: 7fe8104daf9ebd5c2ac427ec7312cd9456195b1a8ade188fa8bfd35e43bc0614:7ilBNt4q5xYUSMyv8UX2a7gkmwv051Pm:1 this is the format: A:B:C Where B = $salt = random string of 32 characters A =...


6

You can generate a Magento 2 style password hash quite easily via PHP on command line (CLI). Use this command to generate a hash, as example for password test123 (change that into your own password): php -r '$salt=md5(time()); echo hash("sha256", $salt.$argv[1]).":$salt:1\n";' test123 It is using MD5 of current Epoch time (time()) as a salt, but you can ...


6

Solution 1 Go to database table core_resource, Find an entry for your module- could be customer_flowpassword_setup - and delete it. Now refresh any page on your magento setup. It should re-run your setup script and will create table. Don't forget to refresh your cache. Solution 2 Directly run below SQL in your database. CREATE TABLE `...


6

Let's say you installed Magento 2 that has the following constants: /** * Key of md5 algorithm */ const HASH_VERSION_MD5 = 0; /** * Key of sha256 algorithm */ const HASH_VERSION_SHA256 = 1; /** * Key of latest used algorithm */ const HASH_VERSION_LATEST = 1; Later in time, you upgrade Magento and a new version of the used algorithm has been ...


6

Try this: Replace testtest with your new password and $customer_entity_id with the customers entity_id in the customer_entity table. update customer_entity_varchar set value = md5('testtest') where entity_id=$customer_entity_id and attribute_id in (select attribute_id from eav_attribute where attribute_code = 'password_hash' and entity_type_id = 1);


5

Magento has perform server side validation for customer registration, so conformation password is must. Copy this file to your theme with correct folder structure /app/design/frontend/base/default/template/persistent/customer/form/register.phtml Then make conformation password field as hidden <input type="hidden" name="confirmation" title="<?php ...


5

Finally, I was able to solve the issue. I have to mention it is really not good that magento core files have this kind of issues when they secure the passwords, guess the core developers forgot some simple things. Ok, so to fix this issue you have to override the core customer model in local like app/code/local/Mage/Customer/Model/Customer.php. In that go ...


5

Actually i think it should be enough to update the password when a customer signs up via register when a customer signs up during checkout after a password change in the customer acount after a password change from the Magento backend The password should not change inbetween so I think updating it on every login is not necessary. Regarding the "strange ...


5

The save method of the class Magento\Customer\Model\ResourceModel\CustomerRepository has an extra argument passwordHash Use this argument to set a new password: $customer = $this->customerRepository->getById($customerId); $this->customerRepository->save($customer, $this->encryptor->getHash($password, true));


5

Thanks Ankit Shah, Solution here : https://magento.stackexchange.com/a/141422/43576 "As of version 2.1.1 this is a configuration item. In Stores > Configuration > Customers > Customer Configuration > Password Options there's some options like Password Length and Number of Required Character Classes. Not sure at which version this was introduced but if you ...


5

This is the method that hashes a password: public function getHash($password, $salt = false, $version = self::HASH_VERSION_LATEST) { if ($salt === false) { return $this->hash($password); } if ($salt === true) { $salt = self::DEFAULT_SALT_LENGTH; } if (is_integer($salt)) { $salt = $this->random->...


5

I searched a little and found out that magento2 uses EncryptorInterface class to encrypt and decrypt the password. You can use it this way: use Magento\Framework\Encryption\EncryptorInterface as Encryptor; in the construct function : $this->encryptor = $encryptor; then call encrypt function to encrypt: $encrypt = $this->encryptor->encrypt($...


5

This is a bug in Magento core, not recognizing your "table prefix" (confimed here) See: /app/code/core/Mage/Customer/Model/Observer.php Original code doesn't check for prefix ... public function deleteCustomerFlowPassword() { $connection = Mage::getSingleton('core/resource')->getConnection('write'); $condition = array('requested_date < ?' =&...


5

I was able to resolve this issue by going into the admin_passwords table, and removing the stored passwords associated with the admin users' ID. Not sure if this was the right way to go about it, but it solved this issue and hasn't caused any adverse effects, as far as I can tell.


5

As @Raphael at Digital Pianism mention, It helps to increase customer security(Password security), you can check below code what Magento actually does when you run this command, $this->collection = $this->customerCollectionFactory->create(); $this->collection->addAttributeToSelect('*'); $customerCollection = $this->...


5

I have completed by below code public function __construct( \Magento\Customer\Model\CustomerRegistry $customerRegistry, \Magento\Customer\Api\CustomerRepositoryInterface $customerRepository, ) { $this->_customerRegistry = $customerRegistry; $this->_CustomerRepositoryInterface = $customerRepository; } Use below code in my custom ...


5

Override login file into your theme if not override yet. app\design\frontend[VENDOR][THEME]\Magento_Customer\templates\form\login.phtml In above override phtml file, after password input field or next to password input field add below code <div id="password-strength-meter-container" data-role="password-strength-meter" aria-live="polite"> <...


5

@chirag, Thanks for your suggestion and from your suggestion i have made changes in register.phtml file and now my requirement is working. Please check below my code. app/design/frontend/Custom/theme/Magento_Customer/templates/form/register.phtml I have added below script. <script type="text/javascript"> require([ 'jquery', 'jquery/ui', ...


4

Simple solution is to make the passwords fields hidden and fill them with a random value. Just make sure it's the same for the password field and the confirmation field. See here some code that can be used. It is for hiding the password in the checkout section but it should be the same for registring.


Only top voted, non community-wiki answers of a minimum length are eligible