hi
when i invite a friend, the module doesnt check that email exists as a registered user in the site's database.

therefore i can invite myself over and over again. if this module was used in conjunction with userpoints module for example, it could lead to a misuse of the system.

thanks

Comments

ajk’s picture

ajk commented

Good catch, I'll roll the fix for this into my mega bug fix patch tomorrow. Hopefully, Nick will get some time soon to review all this work I'm doing and commit it ;)

ajk’s picture

ajk commented
Status: Active » Fixed

Fixed in http://drupal.org/node/85708

Note, it can still be abused by simple "inviting" a@a.com, b@b.com, etc. So long as the email is sntax correct the only way to be sure is to look for a bounce message and that's beyond Drupal. So, if you are using Userpoints module, it's best not to award points for just "an invite"

Anonymous’s picture

(not verified) commented
Status: Fixed » Closed (fixed)