When using logintoboggan to automatically log in newly registrated users with a non-authenticated role, roledelay creates a security hole by allowing unverified users to simply wait for their permissions, without ever validating their registration via email. This patch adds a setting to change the roledelay timer to start when logintoboggan verifies, not immediately upon registration. NOTE: This patch shouldn't be integrated unless logintoboggan accepts my one line patch adding a hook when it email validates.
| Comment | File | Size | Author |
|---|---|---|---|
| #3 | roledelay.module_2.patch | 2.94 KB | mcarbone |
| #2 | roledelay.module_1.patch | 2.69 KB | mcarbone |
| #1 | roledelay.module_0.patch | 2.69 KB | mcarbone |
| roledelay.module.patch | 2.63 KB | mcarbone |
Comments
Comment #1
mcarbone commentedApologies -- I missed something the first time around. Here's the corrected patch.
Comment #2
mcarbone commentedAt the behest of Gary Feldman over at logintoboggan, I modified the hook op for when logintoboggan validates from 'validate' to 'update.' All other changes are the same.
Comment #3
mcarbone commentedThe invocation from logintoboggan's end is still in flux, but I've attached the latest patch to conform with their end. Still, I'd consider this patch on hold until the logintoboggan side is approved.
Comment #4
mcarbone commentedComment #5
Anonymous (not verified) commentedAutomatically closed -- issue fixed for two weeks with no activity.