Shoutbox

solution please.....

You wrote a comma instead of a dot in batigolo0o@hotmail.com, that's why it did not recognise your email adress. I've changed the comma to a dot now and generated a new password just in case you forgot your pw too. You can change the pw into anything you want (I can not see what it is or was set too). You should receive an email about the password. If not, get back to me here.

quote:

---

Originally posted by Sunshine
You wrote a comma instead of a dot in batigolo0o@hotmail.com, that's why it did not recognise your email adress.

---

Isn't that a bug in the system then?
Because AFAIK commas are not allowed in email addresses, or at least not in the place where it was.
Maybe a better/stricter email validator would prevent such booboos

quote:

---

Originally posted by Sunshine
You wrote a comma instead of a dot in batigolo0o@hotmail.com, that's why it did not recognise your email adress. I've changed the comma to a dot now and generated a new password just in case you forgot your pw too. You can change the pw into anything you want (I can not see what it is or was set too). You should receive an email about the password. If not, get back to me here.

---

really thanks sooooooooo much

quote:

---

Originally posted by CookieRevised

quote:

---

Originally posted by Sunshine
You wrote a comma instead of a dot in batigolo0o@hotmail.com, that's why it did not recognise your email adress.

---

Isn't that a bug in the system then?
Because AFAIK commas are not allowed in email addresses, or at least not in the place where it was.
Maybe a better/stricter email validator would prevent such booboos

---

indeed. And if you guys are planning update the account-related script, please consider change the way "forgot password" code works:
after user submitted their email address, send a link (with some unique hash/id, which could be a MD5 hash from old email + new email, granted it would require an aditional field in the users database). The user then will require visit that address where they can change their password.
This method will help if: a) email address is no longer valid and later user remember their password. b) somebody else submitting your email, therefore messing up your current password.

The same could be applied to email change routine. It would prevent from accidents as in this topic.

quote:

---

Originally posted by V@no
after user submitted their email address, send a link (with some unique hash/id, which could be a MD5 hash from old email + new email, granted it would require an aditional field in the users database). The user then will require visit that address where they can change their password.

---

... although it shouldn't be a hash of the old and new email address because that can easily be guessed, calculated and abused too. It should be like in any other 'forgot pwd' system: just a random GUID, impossble to guess, and which expires after a very short time. Otherwise it will not solve your point B either.

And as for your point A: that can't be solved like that in a secure way. The user must always have access to the email address he provided when he signed up, otherwise he is out of luck. The ability to enter an alternative email address to send the link to, without any further validation, is a very massive 'no-no' and an open door for hacking. Stuff like this is usually solved by setting an alternative email address in your user profile _after_ you have successfully signed in (thus with the correct password); it is never asked, and should never be asked when you click a "forget pwd" link. The user should be able to select the option to send the link to his lternative email though, provided he set one up before.

Either way, yes, that "forget pwd" system should indeed be revised too.