View Issue Detail

ID	Project	Category	Submitted / Last Updated
01390	UserSpice	ACP Code	2021-11-13 05:10:04 / 2021-11-19 05:49:55
Reported	Brandin Arsenault	Assigned To	Unassigned
Priority	none	Reported	5.3.7
Status	closed	Resolution Version and Commit
Summary	Extend validation for forgot_password
Description	The email_act is not checked on forgot_password.php in line 33. We can extend this by checking if the email_act is null or set to empty. Original notes: 3. The condition to allow forgot password functionality is rather weird. I fixed it like this: users/forgot_password.php - if($em->email_login == "yourEmail@gmail.com"){ if(!$em->email_act){

November 2021

I think there is a misunderstanding here. email_act forces users to verify their email, but you do not need that feature enabled to allow password resets. If you are not forcing verification on the user but they enter a fake email address and cannot reset their password...shame on them,