Authenticate/confirm registration/forgot password

[iamdamnsam]

I think this was brought up before but I am doing it again.

I think there should be an authentication when a person registers on a board, like some of the other Message Board systems out there.

What I mean is when they sign up, they get an email sent to them and they have to click on a link that confirms their registration.  If they don't confirm, then they don't ever get added to the members database.  It is a good way to only have real members on your board.

I think this should also be done for the forgot password.  I have been having problems lately with people using the forgot password link and just putting membernames in there to screw people up.  I know the new password is emailed to the member, but it is kind of a pain for that member to have relogin if they use the "Always Stay Logged In".

So I think both the member registration and the forgot password should use a confirm link that emails the user and they have to click on that link before anything is done to the database.

Another thing I would like to see is to be able to set certain boards to have post expirations.  Like have A board expire posts every 30 days.

[iamdamnsam]

Does nobody think this is needed?  Let me give you a scenerio:

Some jerk goes and uses the forgot password link on about 30 or your members.  All 30 members passwords will be reset.  I know they get an email letting them know, but maybe some people don't check their email often.  Besides, this is a pain in the arse for those members, especially if this is happening daily.

If instead of giving them a new password when they use the forgot password link, an email was sent to them stating that someone used it, if they did it to confirm it follow a link, which resets their password and sends them an email with their new password.

Another Scenerio:

Some jerk writes a little prog that will go in and register on your board, and they flood your site with hundreds of registrations, with bogus info and email address's.  

If there was a confirm, when they register, an email would be sent to them to confirm the registration, and when they click on the link, it then writes the user's info to the database.

[Ally6]

I think that you can only appreciate yr 'scenarios' if you have a resident jerk, and god do i have one!  

I agree that that yr suggestion would be very helpful, i have also suggested a mod where members have to use their isp addresses to sign up eg; [email protected], free accounts are too easy to hide behind when someone is giving you hell.  

[iamdamnsam]

That is true, but some people who borrow other people's computer may not be able to get a non free email account.

I know a large majority of my members have yahoo and hotmail accounts.

[Ally6]

I'm hearing you, i think at this stage im prepared to forfeit quantity of members for quality.

[sylvester]

I think this was brought up before but I am doing it again.

I think there should be an authentication when a person registers on a board, like some of the other Message Board systems out there.

What I mean is when they sign up, they get an email sent to them and they have to click on a link that confirms their registration.  If they don't confirm, then they don't ever get added to the members database.  It is a good way to only have real members on your board.

I think this should also be done for the forgot password.  I have been having problems lately with people using the forgot password link and just putting membernames in there to screw people up.  I know the new password is emailed to the member, but it is kind of a pain for that member to have relogin if they use the "Always Stay Logged In".

So I think both the member registration and the forgot password should use a confirm link that emails the user and they have to click on that link before anything is done to the database.

Another thing I would like to see is to be able to set certain boards to have post expirations.  Like have A board expire posts every 30 days.

that's a good idea. I'll try to make that mod (you have to wait a couple of days )

[iamdamnsam]

You rule sylvester!

[sylvester]

You rule sylvester!

thnx, but don't say that to early

[iamdamnsam]

I tried doing it by making the whole password rewrite routine a new function, and when someone searches for their username or email, the email that normall sends them their password would send them a link that was calling that function.  But, to the not so dumb, they would catch on and just use the url that calls that function.  I don't know a way to make each password request authenticate, so I gave up.  I hope you can figure it out.

[sylvester]

I tried doing it by making the whole password rewrite routine a new function, and when someone searches for their username or email, the email that normall sends them their password would send them a link that was calling that function.  But, to the not so dumb, they would catch on and just use the url that calls that function.  I don't know a way to make each password request authenticate, so I gave up.  I hope you can figure it out.

if you register, you don't reveice an e-mail with your password or something like that. You receive a link, if you confirm your request (with your unique id ), you'll receive an e-mail with your password.
I have to think about the details
wish me luck

[iamdamnsam]

That is exactly what I mean.  Can you do it with the forgot password too?  I hope so.  Thanks!

[sylvester]

The registration part is done. I'm going to work on the forgot-password part

[sylvester]

I've done the forgot-password section too
I'll release this mod in a couple of days (I think tomorrow)

[iamdamnsam]

Wow, that is great.  Fast work!  Thanks for doing that!

[iamdamnsam]

Any update on this?  If you don't feel like making a mod file, could you let me know what you changed, I do all my stuff by hand anyways.  Thanks.