I believe GetPassword() should, if possible, return the unencrypted password. However, as currently written it returns whatever's in the Member system, which can be encrypted.

This could be fixed by changing the lines:

            if (m == null)
            {
                throw new MembershipPasswordException("The supplied user is not found");
            }
            else
            {
                return m.Password;
            }

to:

            if (m == null)
            {
                throw new MembershipPasswordException("The supplied user is not found");
            }
            else
            {
                return UnEncodePassword(m.Password);
            }

UnEncodePassword is an existing helper method in the provider.

I would be happy to submit a patch. However, I've never done that before. Are there instructions on how to do that?

- Mark