Integration with logintoboggan
mcarbone - January 17, 2007 - 00:39
| Project: | Role Delay |
| Version: | 5.x-1.x-dev |
| Component: | Code |
| Category: | feature request |
| Priority: | normal |
| Assigned: | Unassigned |
| Status: | closed |
Description
When using logintoboggan to automatically log in newly registrated users with a non-authenticated role, roledelay creates a security hole by allowing unverified users to simply wait for their permissions, without ever validating their registration via email. This patch adds a setting to change the roledelay timer to start when logintoboggan verifies, not immediately upon registration. NOTE: This patch shouldn't be integrated unless logintoboggan accepts my one line patch adding a hook when it email validates.
| Attachment | Size |
|---|---|
| roledelay.module.patch | 2.63 KB |
#1
Apologies -- I missed something the first time around. Here's the corrected patch.
#2
At the behest of Gary Feldman over at logintoboggan, I modified the hook op for when logintoboggan validates from 'validate' to 'update.' All other changes are the same.
#3
The invocation from logintoboggan's end is still in flux, but I've attached the latest patch to conform with their end. Still, I'd consider this patch on hold until the logintoboggan side is approved.
#4
#5
Automatically closed -- issue fixed for two weeks with no activity.