08-25-2016, 06:34 PM
Not sure if this is a bug or by design... I have "Require User to Verify Their Email?" set to "yes" in the email settings and it seems to work fine on initial registration, but once I am registered I can go in and change the email in the account settings with no verification.
So, thinking like a bad guy, I could sign up and get a valid account and then change my email to someone else's address and then suddenly emails that are "verified" are actually not verified...
As far as I see there is no record of the initial, verified address, either...
And the column "email verified" in the "users" table still indicates 1.
Maybe this is standard behavior for user systems - I'm not sure I ever tested it on another system before. But I can see how it could be a cause for abuse/misuse so I'm throwing it out here.
So, thinking like a bad guy, I could sign up and get a valid account and then change my email to someone else's address and then suddenly emails that are "verified" are actually not verified...
As far as I see there is no record of the initial, verified address, either...
And the column "email verified" in the "users" table still indicates 1.
Maybe this is standard behavior for user systems - I'm not sure I ever tested it on another system before. But I can see how it could be a cause for abuse/misuse so I'm throwing it out here.