Help needed on password reminder

[Starks]

Hi,

Someone is going to the "forgot password" section, and writing one of my moderator's username. Of course it's sent to his mail address but the password is changed. Everytime he has to modify it and it's annoying.  This has been done 3 or 4 times in the past week. (to the same moderator)

Is there a way to prevent this and can I somehow learn who is doing that?

Thanks very much.  

[andrea]

Maybe it is just somebody with a similar name. Needs not to be malevolent.

[[Unknown]]

Darn!  I forgot to add that.

Keep a look out for Enhanced Security 1.3.  I was *planning* on making it have an option to turn off the forgot password feature for specific membergroups.... then you could just tell it not to allow it for Moderators.

-[Unknown]

[Ben_S]

how about doing what phpnuke does (or similar).

When you use the forgot password option, rather than changing the password stright away, it emails a confirmation code, you then use the confirmation code to request a new password, this stops anyone requesting new passwords for the sake of it, as for the password to be changed, they need the confirmation code from the email

[Michele]

Make the following changes to Reminder.php. Then when someone does that to your moderator again, ask him what the IP was listed in the email. Then ban the IP.

Code Select Expand


<search for>
global $secretAnswer, $passwrd1, $passwrd2;
</search for>

<add after>
global $REMOTE_ADDR;
</add after>

<search for>
   sendmail($email, $subject, "$txt[711] $name,\n\n$mbname ==>\n\n$txt[35]: $member_name\n$txt[36]: $password\n$txt[87]: $status\n\n$txt[130]",$webmaster_email);
</search for>

<replace with>
   sendmail($email, $subject, "$txt[711] $name,\n\n$mbname ==>\n\n$txt[35]: $member_name\n$txt[36]: $password\n$txt[87]: $status\nIP: $REMOTE_ADDR\n\n$txt[130]",$webmaster_email);
</replace with>


HTH, Michele