2

You can do this by overriding fromName and fromEmail in the mailer component config based on your site handle (or language). You would do this in your config/app.php like so: 'components' => [ 'mailer' => function() { // Fetch the site the user is on $currentSiteLanguage = Craft::$app->getSites()->currentSite->handle; ...


1

Without looking at the core code, I imagine that the setpassword action is only looking for the very specific fields it needs to reset the users password, saving the record, and redirecting to the next screen. You could try creating a custom module that includes a hook to listen for the craft\elements\User::EVENT_BEFORE_SAVE event trigger. Within that hook ...


1

If the user already has an elevated session then they do not need to enter their current password. You can see the relevant code for this check here: https://github.com/craftcms/cms/blob/bd3820f19a0680c635a89c7f16805299964d97f2/src/controllers/UsersController.php#L1713-L1721 That is the only explanation I can come up with for the difference in what you are ...


1

You can also use front-end form validation to enforce stronger passwords than the Craft default, either with inbuilt browser functionality using the pattern attribute (more on that here) or JavaScript. It's not bulletproof by any means but it's an extra layer and it's the easiest way of implementing a stronger password policy for registering users. I've used ...


1

AFAIK, there’s no current first-party policy enforcements, but there is this plugin we’ve used in the past to make sure passwords aren’t easily guessed or previously pwned. I would give it a go in the meantime.


Only top voted, non community-wiki answers of a minimum length are eligible