Currently, when someone requires a password recovery to access the forum all he has to do is fill in the Password Recovery form and a new password will be created and emailed to him.
The problem with the current process is that someone can request a new password by providing either a username or an email address of a registered user. Since the usernames are public, anyone can reset someone else's password at any given time!
I believe the password recovery process should change so that it doesn't generate a new random password that is emailed to the user but rather to send a link to the user which will allow him to choose a new password.
Topic Options
Post Options
Thanks(0)
