search

esotalk / esoTalk

Fat-free forum software.
GNU General Public License v2.0
1.47k stars 237 forks source link

Email changing algorithm could be a security issue #342

Open inliquid opened 10 years ago

inliquid commented 10 years ago
  1. I think there should be email validation before changing any mail to new address, in example - esoTalk will send special link to validate that the user owns new mailbox (otherwise some account could be used to flood or any other abuse of target mail address).
  2. Old address should be notified that email was changed. So the user may contact Administrator in case his account was stolen. If there is no notification, and someone can sniff the password - any account can be lost with no possibility to prove who was an initial owner.
  3. The event of changing the email address is not logged anywhere. I think it has to be logged at least in 'activity' table for administrator being able to look directly in DB. But would be better to have whole user security history from Admin panel.
tvb commented 9 years ago

Yes. I agree to all of these points.