Lost password => vulnerability: spam

[code monkey]

Let's say I register for an account. I post an item for sale.
User contacts me about the item using "contact publisher". When I receive the message, I email the user back.
This person now has the email I use with my account.

He can go to index.php?page=login&action=recover, type in my email address, then hit submit.
Each time he clicks refresh (F5), I get spammed with an email.

Also, my password is changed immediately - without verification required after receiving the email.
So any person who knows I use the classified website can mess with my password.


Improvement suggestions:

1. Add captcha to password recovery page. (I also suggest adding this to all non-member pages, like login and contact site owner).

2. Don't change password when the recovery is started. Instead, store the pass_recovery request in db table:

os_t_user_pass_temp:
=> fk_i_user_id
=> dt_date
=> recovered
=> warning

And send an email with verify_password_recovery URL. "Password recovery has been initialized for your account at http://demo.osclass.org. If this was you, click here to complete password reset."
When the user clicks the link from the email, THEN send the email with the new password.

In the email, add a link: "Cancel this request, it wasn't me! I have my password." Clicking this link will terminate the request and block further password recovery attempts, for this email, for 48 hours. Set => warning = 1.

3. If there is a pending pass_recovery request, don't send a second email. "Password recovery for this account is already in progress. Check your email for instructions."

4. When recovery is completed, set => recovered = 1. But leave it in the db table. If someone attempts recovery again within the next 24 hours: "Your password was recovered recently. Please wait 24 hours to try again."

5. Cron: after 24 hours, delete records where recovered = 1 and warning = 0.
After 48 hours, where recovered = 1 and warning = 1.

[_CONEJO]

Hi,

Password SHOULD NOT change when you hit "I lost my password". Instead, and email is sent to you, we create a temporary code/secret which is use to change the password (but the password is the same, it didn't change until you do click on the email link). Besides that, we also take record on the date+time and IP from which the "i forgot my password" button was hit.


I created this : http://issues.osclass.org/browse/OSCLASS-412

[code monkey]

I was looking around the Email templates in the admin area, and I found the template: email_user_forgot_password. So it seems the components are there. But yes, when I use password reset, it sends the password right away.

Also, the email sent with user password isn't in the templates area. Maybe we can add it to there so the style can be edited.

[_CONEJO]

I uploadede the fix this afternoon. For some reason from 1.2 to 2.0 someone re-do the whole section from scratch. It should be working now (at least it does for me) but tomorrow will do the unit testing on that section to be sure.

Thanks for the feedback.