when changing email - authentication is needed
Brought to you by:
amitbarak
Menu
▾
▴
2010/08/14 - adding actions to change email address, as well as email address validators.
If users find out their email address is invalid they may now change their email, however, event if the email IS valid, they may change it.
This creates security vulnerability: users may authenticate one address, then change their email address to an address not belonging to them, and cause system emails SPAM someone else's inbox.
Therefore, each change of email address should immediately revoke email sending to the new address until it's authenticated (by URL sent to that address)