The only action that takes place when the user clicks the "Logout" link is to execute the "log_off_user.asp" which simply appends "LOGGED-OFF" to the username and stores it in the cookie under "UID" instead of the UserCode. No change is made to the database.
The usercode is created or changed by the function "UserCode" and except for admin functions, is only used by: 1) register.asp when a user creates their account or makes changes to their activated account, 2) activate.asp to set a new usercode when the user activates their account from the emailed URL, 3) forgotten_password.asp to set a new usercode when the user requests a password change, and 4) in login_user.asp where every time the user authenticates, a new usercode is created which prevents a user from logging on at multiple computers.
The culprit is #4...login_user.asp. The new user code is generated EVEN IF the account is not yet activated but the password is correct. So I was wrong. It appears to be over-anxious users who aren't waiting for their activation email before attempting to log in.
To fix it, open login_user.asp. First, add the "Active" field to the primary query:
strSQL = "SELECT " & strDbTable & "Author.Password, " & strDbTable & "Author.Salt, " & strDbTable & "Author.Username, " & strDbTable & "Author.Author_ID, " & strDbTable & "Author.User_code, " & strDbTable & "Author.Active "
and then add a simple if-then to stop the new user code from being generated if the account is not active:
'For extra security create a new user code for the user
If CBool(rsCommon("Active")) then strUserCode = userCode(strUsername)
This allows a new usercode only if the account is activated. I would also stop the table from updating in the 2 lines immediately below that, but it's most important to stop the new user code from being built.
Since the new usercode IS generated when the user actually does activate, there is little risk in not changing usercodes on login until activation. This login_user.asp usercode change isn't part of 7.01 so that's why I haven't seen it before.
Topic Options
Post Options
Thanks(0)
