[SOLVED] CB Registration Pending Approval Email and Autoactions

[var1_password] works--problem solved

I am now trying to move our site over to Joomla! 3.4.8 using CB 2.0.13 and auto actions 6.2.3

On our current site (not dev site) which uses:

Auto Actions 4.0.0
CBSubs 3
CB 1.9
Joomla 2.5

Using [var1_password] in the language file for the auto generated email, the password was properly included in the email.

Now with Joomla! 3.4.8 using CB 2.0.13 and auto actions 6.2.3 the password in the email is encrypted. Here is an example:

Password: $2y$10$wQ2bo.33IgT.YJEGl0d5GeDAfWxm2a.1uscECalnSThK6a1S5eHVW

I tried using [password] and [PASSWORD] but they are output in the mail as [password] and [PASSWORD]

How can I send the correct password to users in the initial confirmation mail?

Your action is firing too late then and the password has already become encrypted. You need to use an extremely early trigger like onAfterUserRegistration or maybe onAfterUserRegistrationMailsSent or onAfterSaveUserRegistration will work. The [password] substitution is only useful if the password is in the POST otherwise [var1_password] should be used.

Don't know if this usage will even work anymore. We've locked down our usage of plaintext password except when using auto generated passwords. Sending plaintext password in email is a security risk and goes against latest security best standards so we've stopped doing it (you can force it with [PASSWORD] in Pending email).

I have tried every possible combination and it appears that there is no way in the current CB to include the password in the Pending email. Since that is the case, please consider removing the erroneous tool tip for Pending Email Body and Welcome Email Body which still says that [DETAILS] and [PASSWORD] are viable substitutions.

Password can be sent, but it depends entirely on your configuration. If you've CBSubs then you need to send confirmation before payment and you can include [password] in the pending email. You can never send the password in the welcome email unless you're using generated passwords or confirmation/approval are both disabled.