0

Clicking the Update Profile button in the

[wordpress]/wp-admin/profile.php

admin screen will allow the user to update his/her profile including the password.

What is the right action hook to use if you want to capture the new password during this password change?

2 Answers 2

1

I have been looking around the core files searching for hooks, there were very few when it comes to hooking into edit_user() function which updates the user data in profile.php page, so I have finished with some workarounds:

My workaround is to save the user's password in a custom option before the password was updated, and match later with this user's password to see if it has changed:

add_action("check_passwords", function( $user_login, $pass1, $pass2 ) { 

    if ( !is_admin() || !defined('IS_PROFILE_PAGE') || !IS_PROFILE_PAGE )
        return; // not profile.php page, let's mind our business

    update_option( "_se_debug_user_submitted_pass", wp_get_current_user()->user_pass );
    return;

}, 10, 3);

add_action("admin_init", function() { 

    global $pagenow;
    if ( "profile.php" !== $pagenow ) return;
    global $current_user;

    if ( get_option( $opt_name = "_se_debug_user_submitted_pass" ) && (string) get_option( $opt_name ) !== (string) $current_user->user_pass ) {

        // the password has changed.
        echo "Password has changed!";
        /* do things here */

        delete_option( $opt_name ); // do only once
    }

});

That should work and as long as in profile.php page (updating own profile).

To capture the password, after this line:

update_option( "_se_debug_user_submitted_pass", wp_get_current_user()->user_pass );

update a custom option with the new password value $pass2 which is the password confirmation, and call this option within // the password has changed. wrap. THIS IS NOT GOOD AT ALL to get user's plain text passwords, I would never recommend such thing but it's your call and on your own risk. Unless you are capturing the hashed pass then that's totally fine.

One thing is, if the user updates the password but still with the same old pass, this condition will still be fired because the WordPress password hashing system uses randomly-generated salts and therefore the return will be different (powerful security, and I would like to invite you to quit using md5 if you use it for hashing in your projects).

Hope that helps somehow.

0

Sometimes WordPress is running (or it should be running) in sync with some other system, which is my case - users that change their password in WP should have the same new password in one other place - and I need it in plain text at that moment.

The code I used to get the new password, looks a bit cleaner than the previous answer:

// when password is changed from wp-admin (for himself or some other user, if admin)
function update_my_new_password( $user_id ) {

    if ( empty( $_POST['pass1'] ) || $_POST['pass1'] !== $_POST['pass2'] ){
        return;
    }

    // password changed...
    $new_pass = $_POST['pass1'];

}
add_action( 'profile_update', 'update_my_new_password' );

The profile_update hook fires on that admin screen from OP and the condition is met if $_POST['pass1'] is not empty. It will also fire if the new password is the same as the old password.


There is also another case where user can change his password, the lost password feature. The action for that should be after_password_reset or password_reset but I haven't tested that because in my case I need to find the hook for MemberPress plugin which doesn't trigger this particular hook(s).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.