{"action":"created","issue":{"url":"https://api.github.com/repos/PrestaShop/PrestaShop/issues/8270","repository_url":"https://api.github.com/repos/PrestaShop/PrestaShop","labels_url":"https://api.github.com/repos/PrestaShop/PrestaShop/issues/8270/labels{/name}","comments_url":"https://api.github.com/repos/PrestaShop/PrestaShop/issues/8270/comments","events_url":"https://api.github.com/repos/PrestaShop/PrestaShop/issues/8270/events","html_url":"https://github.com/PrestaShop/PrestaShop/pull/8270","id":252555898,"number":8270,"title":"Allow modifying IdentityController to save personal information without password","user":{"login":"MDWeb-Lille","id":3843844,"avatar_url":"https://avatars0.githubusercontent.com/u/3843844?v=4","gravatar_id":"","url":"https://api.github.com/users/MDWeb-Lille","html_url":"https://github.com/MDWeb-Lille","followers_url":"https://api.github.com/users/MDWeb-Lille/followers","following_url":"https://api.github.com/users/MDWeb-Lille/following{/other_user}","gists_url":"https://api.github.com/users/MDWeb-Lille/gists{/gist_id}","starred_url":"https://api.github.com/users/MDWeb-Lille/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MDWeb-Lille/subscriptions","organizations_url":"https://api.github.com/users/MDWeb-Lille/orgs","repos_url":"https://api.github.com/users/MDWeb-Lille/repos","events_url":"https://api.github.com/users/MDWeb-Lille/events{/privacy}","received_events_url":"https://api.github.com/users/MDWeb-Lille/received_events","type":"User","site_admin":false},"labels":[{"id":331183814,"url":"https://api.github.com/repos/PrestaShop/PrestaShop/labels/QA-approved","name":"QA-approved","color":"009800","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2017-08-24T10:21:11Z","updated_at":"2018-03-27T16:48:55Z","closed_at":"2018-03-27T16:48:46Z","author_association":"NONE","pull_request":{"url":"https://api.github.com/repos/PrestaShop/PrestaShop/pulls/8270","html_url":"https://github.com/PrestaShop/PrestaShop/pull/8270","diff_url":"https://github.com/PrestaShop/PrestaShop/pull/8270.diff","patch_url":"https://github.com/PrestaShop/PrestaShop/pull/8270.patch"},"body":"Allow modifying IdentityController to save personal information without password\r\n\r\n<!-- Thank you for contributing to the PrestaShop project! \r\n\r\nPlease take the time to edit the \"Answers\" rows with the necessary information: -->\r\n\r\n| Questions     | Answers\r\n| ------------- | -------------------------------------------------------\r\n| Branch?       | develop\r\n| Description?  | Note: This should NOT be viewed as completely deactivating password check on the personal informations page.<br/><br/>It is currently mandatory to enter your password to save personal information.<br/>We have been trying to modify that behaviour for some customers, and some code have been implemented in that sense but not all the way through:<br/>-In IdentityController::initContent(), setting ->setPasswordRequired to false on the customer form should work but doesn't, we get an error message for Invalid password<br/>-Setting ->setAskForPassword to false seemed like the logical next step so the field is not checked and not displayed, and it does remove the field but submitting only end in a 500 Fatal Error <br/><br/>Code in IdentityController to reproduce:<br/>$customer_form->getFormatter()<br/>    ->setAskForNewPassword(true)<br/>    ->setPasswordRequired(false)<br/>    ->setAskForPassword(false)<br/>    ->setPartnerOptinRequired($customer->isFieldRequired('optin'))<br/>;<br/><br/>Our goal was to allow third-party login on a shop we're working on. The customer logs in using Facebook, a customer account is created with a random password he is unaware of, and he thus cannot modify his personal information without using password recovery.<br/>It seems like bad practice that a customer using third-party login should use a password at all as the third-party is ensuring security here and our only concern should be that he is connected.<br/><br/>This fixes some of the partially implemented code to allow a simpler override to change that setting, possibly adding a Configuration value in the future on that setting, or in our case adding a Hook for the third-party login module to allow or disallow saving without password depending on the current user.<br/><br/>We have tested trying to save on a different id_customer, replacing an existing email address... and all security tests were OK.\r\n| Type?         | improvement\r\n| Category?     | CO\r\n| BC breaks?    | no\r\n| Deprecations? | no\r\n| Fixed ticket? | http://forge.prestashop.com/browse/BOOM-3709\r\n| How to test?  | Set $password_required = false at top of IdentityController. You may now change personal information without entering your password.\r\n\r\n<!-- Click the form's \"Preview button\" to make sure the table is functional in GitHub. Thank you! -->\r\n\r\n#### Important guidelines\r\n\r\n* Make sure [your local branch is up to date](https://help.github.com/articles/syncing-a-fork/) before commiting your changes!\r\n* Your code MUST respect [our Coding Standards](http://doc.prestashop.com/display/PS16/Coding+Standards) (for code written in PHP, JavaScript, HTML/CSS/Smarty/Twig, SQL)!\r\n* Your commit name MUST respect our [naming convention](http://doc.prestashop.com/display/PS16/How+to+write+a+commit+message)!\n\n<!-- Reviewable:start -->\n---\nThis change is [<img src=\"https://reviewable.io/review_button.svg\" height=\"34\" align=\"absmiddle\" alt=\"Reviewable\"/>](https://reviewable.io/reviews/prestashop/prestashop/8270)\n<!-- Reviewable:end -->\n"},"comment":{"url":"https://api.github.com/repos/PrestaShop/PrestaShop/issues/comments/376595421","html_url":"https://github.com/PrestaShop/PrestaShop/pull/8270#issuecomment-376595421","issue_url":"https://api.github.com/repos/PrestaShop/PrestaShop/issues/8270","id":376595421,"user":{"login":"mickaelandrieu","id":1247388,"avatar_url":"https://avatars2.githubusercontent.com/u/1247388?v=4","gravatar_id":"","url":"https://api.github.com/users/mickaelandrieu","html_url":"https://github.com/mickaelandrieu","followers_url":"https://api.github.com/users/mickaelandrieu/followers","following_url":"https://api.github.com/users/mickaelandrieu/following{/other_user}","gists_url":"https://api.github.com/users/mickaelandrieu/gists{/gist_id}","starred_url":"https://api.github.com/users/mickaelandrieu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mickaelandrieu/subscriptions","organizations_url":"https://api.github.com/users/mickaelandrieu/orgs","repos_url":"https://api.github.com/users/mickaelandrieu/repos","events_url":"https://api.github.com/users/mickaelandrieu/events{/privacy}","received_events_url":"https://api.github.com/users/mickaelandrieu/received_events","type":"User","site_admin":false},"created_at":"2018-03-27T16:48:55Z","updated_at":"2018-03-27T16:48:55Z","author_association":"CONTRIBUTOR","body":"Thanks @MDWeb-Lille !"}}
{"actor":{"display_login":"mickaelandrieu"}}